ML18275A325

Enterprise Project Management Pia 2018

ML18275A325
Person / Time
Issue date:	01/08/2019
From:	Anna Mcgowan Information Services Branch
To:
John Shea
References
Download: ML18275A325 (16)

Text

ADAMS ML18275A325 U.S. Nuclear Regulatory Commission Privacy Impact Assessment Designed to collect the information necessary to make relevant determinations regarding the applicability of the Privacy Act, the Paperwork Reduction Act information collection requirements, and records management requirements.

Enterprise Project Management Enterprise Architecture Number: 20060087 Date: October 9, 2018 A. GENERAL SYSTEM INFORMATION

1. Provide a detailed description of the system:

The Enterprise Project Management (EPM) system is a Major Application owned by the Office of New Reactors (NRO). EPM integrates a Microsoft Enterprise Project Management Solution into a project management interface. EPM assists NRO management in making informed scheduling and resource allocations through actively managing the state and status of all licensing-related activities affecting the complex technical review of new reactor design certifications, license applications, environment reviews, early site permits, limited work authorizations, and plant construction inspections and rule management related activities. EPM gives NRO a 'single place' to manage related subject matter using 'out of the box' features in Microsoft Project and SharePoint services.

EPM will provide the following capabilities:

• Schedule Management and Analysis

• Resource Management

• Collaboration and Workflows

• Views and Reporting Capabilities

• Role Based Access and Permissions

2. What agency function does it support?

EPM supports the following agency functions:

• Provide a standardized, automated approach to manage multiple projects across the agency providing a common resource pool to be used by the entire agency.

• Support a more effective allocation of critical staff and contractor resources avoiding potential resource conflicts resulting in improved project executions.

3. Describe any modules or subsystems, where relevant, and their functions.

SharePoint Environment:

Windows SharePoint Services (WSS) provides team services and Web sites for information sharing, workflows, and document collaboration.

Several functions have been integrated into the SharePoint environment in EPM:

• The EPM Electronic Request for Additional Information (eRAI) subsystem uses SharePoint workflow and project scheduling capabilities to automate document and forms processing and tracking associated with the New Reactor Licensing and Inspection RAI processes. License applicants are required to respond to gaps in address information with application submissions. eRAI allows the NRC to request additional information during the review and approval process. If an applicant fails to respond to an RAI within a specified time frame, NRC can deny an application.

• Construction Inspection Program Information Management System (CIPIMS) uses SharePoint workflows to provide a common tool to plan, schedule, manage, record, and report on inspections related to new reactor construction.

• Verification of ITAAC (Inspections, Tests, Analysis, and Acceptance Criteria) Closure, Evaluation and Status (VOICES) uses SharePoint workflows to verify, evaluate, and track ITAAC closure request reviews.

VOICES is intended to assist the agency in preserving all documents that support or oppose the closing of an ITAAC, and to organize and prioritize those stored documents for efficient access.

• Customer Response Center (CRC) uses SharePoint workflows to facilitate the processing of changes in project schedules and IT tickets.

SQL Server Platform:

• SQL Server Enterprise Business Intelligence provides data warehousing, data mining, data analysis, and querying services capabilities.

• SQL Server Reporting Services (SSRS) is a commercial off-the-shelf (COTS) reporting tool used to design, manage, and deliver reports via the Web and embedded enterprise applications. SSRS provides NRO and the New Reactor Program with seamless, on-demand reporting, key performance indicators, a digital dashboard, and What-If scenario analysis.

Microsoft Project Professional:

MS Project Professional enables project managers to set up projects quickly and efficiently, communicate project data, and track and analyze projects.

EPM also uses Project Web Access (PWA), a web-based interface that provides access to timesheets, project views, document libraries, and issues and risks.

Additionally, PWA provides administrative interfaces for managing role-based security, configuring SharePoint Services integration, and PWA customization.

Oracle Primavera Project Portfolio Management:

EPM uses the Primavera project portfolio management (PPM) solution to:

• Manage construction inspection schedules,

• Review resource loading, and

• View industry construction schedules.

4. What legal authority authorizes the purchase or development of this system?

EPM Business Case has been approved by NRC Management - Please see ML070960268.

5. What is the purpose of the system and the data to be collected?

The Enterprise Project Management (EPM) supports new reactor licensing; inspections design review, licensing, and other offices product line activities.

6. Points of

Contact:

Project Manager Office/Division/Branch Telephone Lew Clayman OCIO 301-415-7565 Business Project Manager Office/Division/Branch Telephone Joe Turner OCIO 301-415-6310 Executive Sponsor Office/Division/Branch Telephone Frederick Brown Director, NRO 301-415-1897

7. Does this privacy impact assessment (PIA) support a proposed new system or a proposed modification to an existing system?

a. New System X Modify Existing System Other (Explain)

b. If modifying an existing system, has a PIA been prepared before?

(1) If yes, provide the date approved and ADAMS accession number.

07/31/2014, ML14199A294

09/20/2017, ML17264A877 (2) If yes, provide a summary of modifications to the existing system.

Updated the systems points-of-contact.

B. INFORMATION COLLECTED AND MAINTAINED These questions are intended to define the scope of the information requested as well as the reasons for its collection. Section 1 should be completed only if information is being collected about individuals. Section 2 should be completed for information being collected that is not about individuals.

1. INFORMATION ABOUT INDIVIDUALS

a. Does this system maintain information about individuals?

Yes (1) If yes, identify the group(s) of individuals (e.g., Federal employees, Federal contractors, licensees, general public).

NRC Employees (2) IF NO, SKIP TO QUESTION B.2.

b. What information is being maintained in the system about an individual (be specific)?

Employee name, work e-mail address, work office, division, and branch information, employee ID, and regular and non-regular hours charged (including leave hours) are maintained within EPM, along with individual work assignments, schedules, and work products status and project completion data.

c. Is information being collected from the subject individual?

Yes (1) If yes, what information is being collected?

Percentage of task/work completed

d. Will the information be collected from 10 or more individuals who are not Federal employees?

No (1) If yes, does the information collection have OMB approval?

Not Applicable (a) If yes, indicate the OMB approval number:

Not Applicable

e. Is the information being collected from existing NRC files, databases, or systems?

Yes (1) If yes, identify the files/databases/systems and the information being collected.

Yes, regular and non-regular hours (including leave hours) associated with Combined Operating License (COL) reviews are collected from the Office of Nuclear Reactor Regulation (NRR),

Replacement Reactor Program System (RRPS).

f. Is the information being collected from external sources (any source outside of the NRC)?

No (1) If yes, identify the source and what type of information is being collected?

Not Applicable

g. How will information not collected directly from the subject individual be verified as current, accurate, and complete?

EPM relies on information that the NRR RRPS system derives from the OCFO Human Resource Management System (HRMS) Time and Labor System. The information includes Cost Accounting Codes (CAC) and hours charged to CAC.

h. How will the information be collected (e.g. form, data transfer)?

Data will be collected through data transfer between the EPM and RRPS systems.

2. INFORMATION NOT ABOUT INDIVIDUALS

a. Will information not about individuals be maintained in this system?

Yes

(1) If yes, identify the type of information (be specific).

The EPM system will maintain staff technical review schedule information including specific review activities with estimated hours, skill sets, estimated start, estimated finish, estimated hours, actual start, actual finish and actual hours.

b. What is the source of this information? Will it come from internal agency sources and/or external sources? Explain in detail.

Project schedules/activities will be loaded by NRO/DNRL. Task assignments will be made by NRO Branch Chiefs. Task status/completion will be entered by staff. Hours charged to a CAC will come from NRR RRPS.

C. USES OF SYSTEM AND INFORMATION These questions will identify the use of the information and the accuracy of the data being used.

1. Describe all uses made of the data in this system.

NRO task planning and scheduling and milestone and deliverable task level reporting.

2. Is the use of the data both relevant and necessary for the purpose for which the system is designed?

Yes

3. Who will ensure the proper use of the data in this system?

The Office of the Chief Information Officer (OCIO) will serve as information custodians ensuring the proper use of the information.

4. Are the data elements described in detail and documented?

Yes

a. If yes, what is the name of the document that contains this information and where is it located?

System Requirements Specification (SRS) document is located in an EPM_20060087 VOB in Rational Jazz Team Server Tool.

5. Will the system derive new data or create previously unavailable data about an individual through aggregation from the information collected?

No

a. If yes, how will aggregated data be maintained, filed, and utilized?

Not Applicable

b. How will aggregated data be validated for relevance and accuracy?

Not Applicable

c. If data are consolidated, what controls protect it from unauthorized access, use, or modification?

Not Applicable

6. How will data be retrieved from the system? Will data be retrieved by an individuals name or personal identifier? (Be specific.)

Information will be retrieved from EPM through the following four methods:

• Monthly Report Outputs (Task Level Summary - No Individual Information). Management reports which will show project completion by task.

• Project Web Access Project Views (Role Based Access Controls). Login only allows staff to access assigned tasks.

• Microsoft Project Professional (Local Desktop - Limited Access for NRO and OCIO staff). Allows loading/modifying of project schedules.

No information will be retrieved by an individuals name or personal identifier.

7. Will this system provide the capability to identify, locate, and monitor (e.g.,

track, observe) individuals?

No

a. If yes, explain.

Not Applicable (1) What controls will be used to prevent unauthorized monitoring?

Not Applicable

8. List the report(s) that will be produced from this system.

The data in the EPM tool produces NRO operational reports, NRO management reports, and NRO project health reports.

a. What are the reports used for?

The data in the EPM system is used to produce reports used for several different functions. Some of the reports are used by NRO staff for operational planning and resource scheduling decisions; other reports are used to inform NRO management as to the status of project milestones,

issues and risks; still others are used to show the project health using earned value management principles.

b. Who has access to these reports?

Reports are limited to NRC staff supporting the New Reactor Program, contractors, and the OCIO Database administrator.

D. ACCESS TO DATA

1. Which NRC office(s) will have access to the data in the system?

Access to EPM data will be limited to NRC staff supporting the New Reactor Program, contractors, and the OCIO Database administrator.

(1) For what purpose?

NRC staff and contractors will be provided discretionary access to information contained within EPM based on their role and new reactor review responsibilities and activities within NRC.

OCIO Database Administration staff will require access to EPM data in order to develop, support, and troubleshoot proposed interfaces with the EPM.

(2) Will access be limited?

Yes

2. Will other NRC systems share data with or have access to the data in the system?

(1) If yes, identify the system(s).

Yes, EPM would have an interface with the NRR RRPS.

(2) How will the data be transmitted or disclosed?

EPM uses SQL server jobs to execute a SQL Server Integration Services (SSIS) package to move data to and from the drop box. The drop box is a general support server owned by OCIO Data Center Services (DCS),

which acts as a temporary holding place for flat files placed by each system (EPM or RRPS). On the RRPS side, the Office of Nuclear Reactor Regulation (NRR) uses shell scripts and cron jobs to transfer flat files to and from the drop box. EPM receives work hours from the time collection system (the RRPS Technical Assignment Control [CAC] table) and sends project task schedule changes and other related information back to RRPS via the drop box.

3. Will external agencies/organizations/public have access to the data in the system?

No (1) If yes, who?

Not Applicable (2) Will access be limited?

Not Applicable (3) What data will be accessible and for what purpose/use?

Not Applicable (4) How will the data be transmitted or disclosed?

Not Applicable E. RECORDS RETENTION AND DISPOSAL The National Archives and Records Administration (NARA), in collaboration with federal agencies, approves whether records are temporary (eligible at some point for destruction/deletion because they no longer have business value) or permanent (eligible at some point to be transferred to the National Archives because of historical or evidential significance). These determinations are made through records retention schedules and are required under 36 CFR 1234.10. The following questions are intended to determine whether the records in the system have an approved records retention schedule or if one will be needed.

1. Can you map this system to an applicable retention schedule in NUREG-0910, or the General Records Schedules at http://www.archives.gov/records-mgmt/grs ?

This system will need to be scheduled; therefore, NRC records personnel will need to work with staff to develop a records retention and disposition schedule for records created or maintained. Until the approval of such schedule, these records and information are permanent. Their willful disposal or concealment (and related offenses) is punishable by fine or imprisonment, according to 18 U.S.C., Chapter 101, and Section 2071. Implementation of retention schedules is mandatory under 44 U.S. 3303a (d), and although this does not prevent further development of the project, retention functionality or a manual process must be incorporated to meet this requirement.

NRC records personnel will need to work with staff to develop a records retention and disposition schedule for records created or maintained. At this time, some

information and records could be applicable under the NRC records schedule (NUREG 0910, 2005) under the Office of Nuclear Reactor Regulation (NRR).

Reference:

Project Records (NARA)

According to NARA, records relating to specific systems that support or document mission goals are not covered by a General Records Schedule (GRS) and must be scheduled individually by the agency by submission of a records schedule to NARA.

a. If yes, please cite the schedule number, approved disposition, and describe how this is accomplished. For example, will the records or a composite thereof be deleted once they reach their approved retention or exported to a file for transfer based on their approved disposition?

b. If the answer to question E.1 is yes, skip to F.1. If the response is no, complete question E.2 through question E.7.

2. If the records cannot be mapped to an approved records retention schedule, how long do you need the records? Please explain.

EPM systems are built on MS SharePoint platforms. So all data housed in EOM systems is also contained within a SharePoint Farm.

The EPM systems store data in SQL Server databases. These databases, and the records they contain, are required for at least as long as the EPM systems are used within NRC.

3. Would these records be of value to another organization or entity at some point in time? Please explain.

It is possible that an oversight, auditing or investigative organization could ask for EPM records.

4. How are actions taken on the records? For example, is new data added or updated by replacing older data on a daily, weekly, or monthly basis?

Database records are sometimes updated many times per day, or records might rarely update but be accessed frequently. Regardless, all systems databases are backed up on a nightly basis. The backups are secured and maintained off-site for 30 days.

5. What is the event or action that will serve as the trigger for updating, deleting, removing, or replacing information in the system? For example, does the information reside in the system for three years after it is created and then is it deleted?

End users update (database) records within EPM systems as they obtain actionable information. Users might update schedules, add inspection notes, indicate ITAAC verifications, remove contacts, etc. from respective systems.

These changes are committed to the back-end database as users move from field to field within their applications. The databases are backed up on a nightly basis. The backups are secured and maintained off-site for 30 days. Back up sets are continuously updated. There is no provision to archive obsolete versions of the databases.

6. Is any part of the record an output, such as a report, or other data placed in ADAMS or stored in any other location, such as a shared drive or MS SharePoint?

EPM systems are built on a SharePoint platform. As such, all data housed in EPM systems is inherently SharePoint data. Therefore, any data element, field, summary metadata, etc., can be used in standard or custom reports. Data could also be incorporated into charts, dashboards or queries. This information is sometimes embedded into Agency documents.

7. Does this system allow for the deletion or removal of records no longer needed and how will that be accomplished?

Yes, data deletion is a fundamental function of database administration. Tables, fields, databases, test instances and/or the information they contain is routinely deleted as systems are modified, updated or retired. These functions, like all system changes, are planned, discussed, documented and submitted to the Agencys Change Control Board as NRC policy dictates.

F. TECHNICAL ACCESS AND SECURITY

1. Describe the security controls used to limit access to the system (e.g.,

passwords).

EPM relies on the Microsoft Windows Server, Project Server, SQL Server, and SharePoint security policies and access rights to protect EPM data from unauthorized access, use, or modification. Additionally, EPM inherits access controls and permissions from the Office of the Chief Information Officer (OCIO)

Information Technology Infrastructure (ITI) General Support System and Data Center Services (DCS).

2. What controls will prevent the misuse (e.g., unauthorized browsing) of system data by those having access?

EPM will rely on agency rules of behavior to ensure proper information usage by individuals that have been granted access. Role-based access controls within EPM also limits misuse of data.

3. Are the criteria, procedures, controls, and responsibilities regarding access to the system documented?

Yes (1) If yes, where?

Information regarding access is documented in the NRO Licensing Program Plan (LPP), EPM System Requirements Specification (SRS),

and EPM System Security Plan (SSP).

4. Will the system be accessed or operated at more than one location (site)?

No

a. If yes, how will consistent use be maintained at all sites?

Not Applicable

5. Which user groups (e.g., system administrators, project managers, etc.)

have access to the system?

EPM access is limited to Data Center Services system administrators, NRO staff Schedulers, and select OCIO support staff to assist in EPM operation and maintenance.

6. Will a record of their access to the system be captured?

Yes

a. If yes, what will be collected?

Yes, access to the servers will be recorded in server security logs.

7. Will contractors be involved with the design, development, or maintenance of the system?

Yes, contractors with access to NRC network will be granted access upon request of the responsible office.

If yes, and if this system will maintain information about individuals, ensure Privacy Act and/or PII contract clauses are inserted in their contracts.

• FAR clause 52.224-1 and FAR clause 52.224-2 should be referenced in all contracts, when the design, development, or operation of a system of records on individuals is required to accomplish an agency function.

• PII clause, Contractor Responsibility for Protecting Personally Identifiable Information (June 2009), in all contracts, purchase orders, and orders against

other agency contracts and interagency agreements that involve contractor access to NRC owned or controlled PII.

8. What auditing measures and technical safeguards are in place to prevent misuse of data?

Access to the servers will be recorded in server application, security, and system logs.

9. Are the data secured in accordance with FISMA requirements?

Yes

a. If yes, when was Certification and Accreditation last completed?

EPM first obtained its Authorization to Operate (ATO) on August 1, 2010 -

ML102010109. The system is currently undergoing re-authorization.

PRIVACY IMPACT ASSESSMENT REVIEW/APPROVAL (For Use by OCIO/ISB Staff)

System Name: Enterprise Project Management Submitting Office: Office of New Reactors A. PRIVACY ACT APPLICABILITY REVIEW X Privacy Act is not applicable.

Privacy Act is applicable.

Comments:

EPM will allow management to assign and track the status/completion of tasks, plan projected workloads. The focus on hours is not who performed the work/task, but the amount of staff hours required to complete the work or task. Information will NOT be retrieved by an individuals name or personal identifier.

Reviewers Name Title Date Sally A. Hardy Privacy Officer 12/28/2018 B. INFORMATION COLLECTION APPLICABILITY DETERMINATION X No OMB clearance is needed.

OMB clearance is needed.

Currently has OMB Clearance. Clearance No.

Comments:

No clearance is needed as information is only being collected from Federal employees.

According to 5 CFR 1320.3, a clearance is needed to collect information from employees of the United States only if the results are to be used for general statistical purposes, that is, if the results are to be used for statistical compilations of general public interest, including compilations showing the status or implementation of Federal activities and programs.

Reviewers Name Title Date David Cullison Agency Clearance Officer 11/05/18

C. RECORDS RETENTION AND DISPOSAL SCHEDULE DETERMINATION No record schedule required.

Additional information is needed to complete assessment.

X Needs to be scheduled.

Existing records retention and disposition schedule covers the system - no modifications needed.

Comments:

This system will need to be scheduled; therefore, NRC records personnel will need to work with staff to develop a records retention and disposition schedule for records created or maintained. Until the approval of such schedule, these records and information are permanent. Their willful disposal or concealment (and related offenses) is punishable by fine or imprisonment, according to 18 U.S.C., Chapter 101, and Section 2071. Implementation of retention schedules is mandatory under 44 U.S. 3303a (d), and although this does not prevent further development of the project, retention functionality or a manual process must be incorporated to meet this requirement.

Reviewers Name Title Date Marna B. Dove Sr. Program Analyst, Electronic Records Manager 12/14/18 D. BRANCH CHIEF REVIEW AND CONCURRENCE X This IT system does not collect, maintain, or disseminate information in identifiable form from or about members of the public.

This IT system does collect, maintain, or disseminate information in identifiable form from or about members of the public.

I concur in the Privacy Act, Information Collections, and Records Management reviews:

/RA/ Date January 8, 2019 Anna T. McGowan, Chief Information Services Branch Governance & Enterprise Management Services Division Office of the Chief Information Officer

TRANSMITTAL OF PRIVACY IMPACT ASSESSMENT/

PRIVACY IMPACT ASSESSMENT REVIEW RESULTS TO: Frederick Brown, Office of New Reactors Name of System: Enterprise Project Management Date ISB received PIA for review: Date ISB completed PIA review:

October 9, 2018 December 28, 2018 Noted Issues:

Information is not retrieved by an individuals name or personal identifier.

Anna T. McGowan, Chief Signature/Date:

Information Services Branch Governance & Enterprise Management /RA/ January 8, 2019 Services Division Office of the Chief Information Officer Copies of this PIA will be provided to:

Tom Rich, Director IT Services Development & Operation Division Office of the Chief Information Officer Jonathan Feibus Chief Information Security Officer (CISO)

Governance & Enterprise Management Services Division Office of the Chief Information Officer