Privacy Impact Assessment - Electronic Project Investment Process (e-PIP)
e-PIP System Overview
DCOS requires an integrated web-based project investment and project estimating process that eliminates duplication of data gathering efforts, manual processing, and practices of ad hoc manual data gathering/reporting. The new electronic Project Investment Process (ePIP) will be a web-based, near real-time, user-friendly, customer-oriented system for requesting and prioritizing space and housing projects based on IRS, BU, MITS, MA and AWSS strategic goals. ePIP provides a front-end customer interface for requesting, prioritizing and funding space and housing projects; and provides all users (project team, BU customers, MITS EUES and EN, REFM and Mission Assurance) with near real-time access to the status of facilities projects throughout the IRS. The web-based screens will provide project work flow; cost estimates; checklists; access to standard templates (Program of Requirements and SF81); schedule; project-related budget status (approved funding, commitment, obligations, and expenditures); monthly progress reports; etc. for space-related projects.
The existing Excel, ACCESS, and Project-based procedures are moved to a web
database using the IRS's standard Intranet browser (no software will be required by the user or customer using his or her local computer).
There will be approximately 500 concurrent users of the enhanced application. The peak period of use will occur during the August through November timeframe.
Approximately 8,000 records will be in the database at one time and over 20 budget object codes will be tracked per facilities projects spanning several years from project planning through delivery and closeout.
System of Records Number (SORN)
Treasury/IRS 34.037 IRS Audit Trail and Security Records System
Data in the System
1. Describe the information (data elements and fields) available in the system in the following categories:
Data elements and fields relate to project work flow; cost estimates; checklists; access to standard templates (Program of Requirements and SF81); schedule; project-related budget status (approved funding, commitment, obligations, and expenditures); monthly progress reports; etc, for space-related projects.
A. Taxpayer n/a
B. Employee
No employee reports are maintained. Certain information is downloaded from existing IRS systems (CADS Discovery Directory to move requests through the system using TIMIS/TAPS to obtain the counts for employees by business unit within a building). Information from the CADS Discovery Directory relates to employees performing their duties by using the system.
C. Audit Trail information (including employee log-in info) n/a
D. Other (Describe) n/a
2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources.
A. IRS n/a
B. Taxpayer n/a
C. Employee n/a
D, Other Federal Agencies (List agency) n/a
E. State and Local Agencies (List agency} n/a
F. Other third party sources (Describe)n/a
3. Is each data item required for the business purpose of the system? Explain. Yes.
4. How will each data item be verified for accuracy, timeliness, and completeness?
A determination will be made for eadch to identify the ppropriate timeframe for updating the data.
5. Is there another source for the data? Explain how that source is or is not used. No.
6. Generally, how will data be retrieved by the users?
The existing Excel, ACCESS, and Project-based procedures are moved to a web
database using the IRS's standard Intranet browser (no software will be required by the user or customer using his or her local computer). System should function without client-sided installation. The e-PIP application should be hosted on a server. The user interacts with the application through a web browser.
7. Is the data retrievab1e by a personal identifier such as name, SSN, or other unique identifier? No.
Access to the Data
8. Who will have access to the data in the administrators system (Users, Managers, System Administrators, Developers, Others)?
Authorized application users and systems administrators.
9. How is access to the data by a user determined and by whom?
Form 5081 will be required for users who require authority or permission to
perform database updates or maintenance.
System log-on should be disabled after 180 days or current IRS standard.
Form 5081 is not required for general access to the system (for customer requests and view only).
Trusted domains will be used as access verification for general user access.
10. Do other IRS systems provide, receive, or share data in the system? If YES, list the system(s) and describe which data is shared. If no, continue to Question 12. Yes.
11. Have the lRS systems described in Item 10 received an approved Security Certification and Privacy Impact Assessment? Yes.
12. Will other agencies provide, receive, or share data in any form with this system? No.
Administrative Controls of Data
13. What are the procedures for eliminating the data at the end of the retention period?
Provide for the capture of historical data and actual project cost/schedule
data.
Provide access to inactive project records for two years after project
"completion" (e.g., customer acceptance).
Provide local-level capability to archive "closed" projects to CD ROM.
Records management procedures for data retention will be applied.
14. Will this system use technology in a new way? If "YES" describe. If "NO" go to Question 15. No.
15. Will this system be used to identify or locate individuals or groups? If so, describe the business purpose for this capability. No.
16. Will this system provide the capability to monitor individuals or groups? If yes, describe the business purpose for this capability and the controls established to prevent unauthorized monitoring. No.
17. Can use of the system allow IRS to treat taxpayers, employees, or others, differently? Explain. No.
18. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action? n/a
19. If the system .is web-based, does it use persistent cookies or other tracking devices to identify web visitors? No.
| 
