Privacy Impact Assessment - Performance Measures for Information Technology Services (PMITS)
PMITS System Overview
The purpose of PMITS is to deliver a web-based means for ITS management officials in campuses and the field to: create reports of MITS Services User Support Balanced Measures and related diagnostic indicators; create user-defined reports pertaining to user support operations; and execute, on a limited basis, ad-hoc queries on user support data. Data to calculate the reports is obtained from weekly extracts of Inventory Technology Asset Management System (ITAMS) problem tickets, monthly extracts from the ITAMS Asset Center, and monthly extracts from the Automated Call Distributor (ACD) at the Enterprise Telephone Data Warehouse.
System of Record Number(s)
N/A
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
A. Taxpayer
B. Employee
C. Audit Trail Information (including employee log-in info)
D. Other (Describe)
A. Taxpayer: There is no taxpayer information used either in the ITAMS data or in ACD data that is loaded into PMITS.B. Employee: Employee data is not available in the reports mode of PMITS.
B. Employee: Employee data is not available in the reports mode of PMITS. In the ticket analysis mode, basic employee information is available for those reporting problems through the ITAMS systems (e.g., name, location, telephone number)
C. Audit Trail Information: The PMITS System Administrators can see whose userID is currently logged into the PMITS system. Only the authorized userlDs are loaded into PMITS.
D. Other: Inventory of equipment and software/equipment or application problem reporting and resolution
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS
B. Taxpayer
C. Employee
D. Other Federal Agencies (List agency)
E. State and Local Agencies (List agency)
F. Other third party sources (Describe)
A. An ITAMS System Administrator exports required data fields from ITAMS database and stores the data tables on their internal data server. The PMITS System Administrator moves the exported dataset into the PMITS development database using the IRS Network.
B. None -Taxpayers do not provide information for PMITS nor can they access PMITS.
C. An IRS employee emails the monthly ACD dataset via IRS Network.
D. None
E. None
F. None
3. Is each data item required for the business purpose of the system? Explain.
Each data item received from ITAMS and ACD has been determined as needed by PMITS to support the production of ticket views and reports that are used by IRS managers to monitor their organizations. SLMO has worked with End User Equipment and Services (EUES) to ensure that the required data fields are extracted so the views and reports are useful to the other IRS Business and Functional Operating Divisions.
4. How will each data item be verified for accuracy, timeliness, and completeness?
PMITS is provided a weekly extract of ITAMS data. Service Level Management Office (SLMO), in the Portfolio Management Division of the Resources Allocation and Measurements (RAM) Organization, MITS Services verifies that the weekly data is correctly loaded into the PMITS Development Database.
5. Is there another source for the data? Explain how that source is or is not used.
There is not another source for the Enterprise Service Desk ticket data. There is not another source for the ACD data.
6. Generally, how will data be retrieved by the user?
The PMITS User will use their intranet web browser to go to the PMITS web page. They will click on the link that brings them to the PMITS login/workstation selection web page. They will select the type of workstation they are using. Next, they will enter their user name and password, assigned by the PMITS System Administrator, to access PMITS. A User can view single tickets or reports (measures, pre-defined, user defined, or previously created reports). PMITS ticket views and reports can be printed using standard software print commands. In general day-to-day use, PMITS users query the report menu to get Balanced Measures reports by organization and/or location. They are also able to view individual tickets using selection criteria. Ticket information is the same as that included in ITAMS. PMITS users can retrieve their own previously saved reports by clicking on that button and selecting one of their reports to view again.
7. Is the data retrievable by a personal identifier such as name, SSN, or other unique identifier?
The PMITS database gets selected ITAMS data fields in the weekly IT AMS data extract. These data fields do not contain SSNs or names of employees who request assistance. The PMITS Ticket Activity screen does not show a name, SSN or other unique identifier selection field. The ITAMS does contain names and telephone numbers of IRS employees and contractors who request assistance from the Enterprise Service Desk. This information resides in ITAMS that has received a Security certification previously.
8. Who will have access to the data in the system (Users, Managers, System Administrators, Developers, Others)?
PMITS Users have the ability to create reports, use defined reports, and execute, on a limited basis, ad-hoc queries. ITS managers have the same ability as users, described above. System Administrators have access to all data to enable them to make necessary and timely corrections to the system. Developers have access to developmental and test versions of data. Others such as network and systems auditors such as the Inspector General for Tax Administration (TIGT A) and General Accounting Office (GAO) may have access to the PMITS logs as part of their official oversight duties.
9. How is access to the data by a user determined and by whom?
The PMITS External Web Server permits access to the PMITS Production Database by authorized users who have submitted a Form5081. A user name and password, assigned by the PMITS System Administrators, is required to enter PMITS.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If NO, continue to Question 12.
Yes. Weekly the ITAMS System Administrator extracts selected data from IT AMS and stores the dataset on an IT AMS data storage server using the IRS Network. The ITAMS System Administrator has granted access to that shared server location to the PMITS System Administrators who use File Transfer Protocol (FTP) to retrieve the dataset and store the data onto the PM ITS development server. The PMITS data does not provide data nor share data with other IRS systems.
11. Have the IRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment?
Yes. ITAMS has received an approved Security Certification and Privacy Impact Assessment. ACD has received an approved Security Certification and Privacy Impact Assessment.
12. Will other agencies provide, receive, or share data in any form with this system?
No other agency, besides the IRS, will provide, receive, or share data in any form with PMITS.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
The IT AMS and ACO datasets are loaded into PMITS and are the basis for historical comparisons of the ITS Balanced Measures. The retention period in PMITS has not been defined. It is expected that procedures on data retention will follow those established by ITAMS.
14. Will this system use technology in a new way? If "YES”, describe. If "NO" go to Question 15. No.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability.
Yes. PMITS users can see a list of tickets located by site/and or organization. Tickets are listed by ticket number not by person's name. The problem description field may, sometimes, contain the name, telephone, location and email address of the requestor. This is due to the method used to request service: telephone, email and web ticketing. PMITS allows ITS managers to review and explore the list of service tickets requesting service from MITS Services. This access can assist in creating reports of ITS User Support Balanced Measures, related diagnostic indicators, and selected operations. It can create user-defined reports pertaining to user support operations.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring.
Yes. PMITS allows groups of users to monitor Enterprise Service Desk tickets by site, by organization, by ticket number, by priority and other "drill down” fields. No. The PMITS Ticket Activity screen does not show a name, SSN or other unique identifier selection field. PMITS does not have any name selection lists or drop-down boxes.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain.
No. PMITS does not contain any taxpayer data. PMITS does not treat employees any differently.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action?
Not Applicable. PMITS only reports status of Enterprise Service Desk tickets. IT AMS contains an established escalation process for Enterprise Service Desk tickets.
19. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors?
No. PMITS is accessed via a web browser that does not use persistent cookies. The Web browser does check the user's personal computer to see if the Jlnitiator applet is installed on the computer. If no Jlnitiator is loaded, the user will have to download the proper Jlnitiator (COE or non-COE workstation) before they can access PMITS.
|
