[Federal Register Volume 88, Number 106 (Friday, June 2, 2023)]
[Notices]
[Pages 36272-36274]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-11753]
========================================================================
Notices
Federal Register
________________________________________________________________________
This section of the FEDERAL REGISTER contains documents other than rules
or proposed rules that are applicable to the public. Notices of hearings
and investigations, committee meetings, agency decisions and rulings,
delegations of authority, filing of petitions and applications and agency
statements of organization and functions are examples of documents
appearing in this section.
========================================================================
Federal Register / Vol. 88, No. 106 / Friday, June 2, 2023 /
Notices
[[Page 36272]]
DEPARTMENT OF AGRICULTURE
Privacy Act of 1974; System of Records
AGENCY: Office of the Safety, Security, and Protection, USDA.
ACTION: Notice of a new system of records.
-----------------------------------------------------------------------
SUMMARY: In accordance with the Privacy Act of 1974, as amended, and
Office of Management and Budget Circular No. A-108 Federal Agency
Responsibilities for Review, Reporting, and Publication under the
Privacy Act, the U.S. Department of Agriculture (USDA) proposes a new
system of records, USDA/OSSP-1, the Enterprise Physical Access Control
System (ePACS). The Office of the Safety, Security, and Protections
maintains ePACS, which contains the information required to control
physical access to USDA managed facilities and restricted areas within
the facilities in all regions across the United States. The notice also
conveys the system location, categories of records, routine uses (one
of which permits records to be provided to the National Archives and
Records Administration), storage, safeguards, retention and disposal,
system manager and address, notification procedures, records access,
and contesting procedures.
DATES: In accordance with 5 U.S.C. 552a(e)(4) and (11) this notice is
applicable upon publication; subject to a 30-day notice and comment
period in which to comment on the routine uses described in the routine
uses section of this system of records notice. Please submit any
comments by July 3, 2023.
ADDRESSES: Comments may be submitted by one of the following methods:
--Federal eRulemaking Portal: This website provides the ability to type
short comments directly into the comment field on this web page or
attach a file for lengthier comments. Go to https://www.regulations.gov. Follow the on-line instructions at that site for
submitting comments.
--Postal Mail/Commercial Delivery: Office of Safety, Security and
Protection, 1400 Independence Ave. SW, Washington, DC 20250.
Instructions: All items submitted by mail or electronic mail must
include the Agency name and docket number USDA-2021-13. Comments
received in response to this docket will be made available for public
inspection and posted without change, including any personal
information, to https://www.regulations.gov.
FOR FURTHER INFORMATION CONTACT: For general questions, please contact
Samuel Willis, System Owner/Manager, Office of Safety, Security and
Protection, 1400 Independence Avenue SW, Washington, DC 20250, (833)
682-4675.
For Privacy Act questions concerning this system of records notice,
please contact Michele Washington, USDA, Departmental Administration
Information Technology Office, Office of the Chief Information Officer
United States Department of Agriculture (202) 577-8021.
For general USDA Privacy Act questions, please contact the USDA
Chief Privacy Officer, Information Security Center, Office of Chief
Information Officer, USDA, Jamie L. Whitten Building, 1400 Independence
Ave. SW, Washington, DC 20250; email: [email protected].
SUPPLEMENTARY INFORMATION: USDA is proposing to establish a new system
of records notice entitled USDA/OSSP-1, the Enterprise Physical Access
Control System (ePACS). The primary purpose of this system is to
collect data required to manage physical access to USDA operated
facilities and restricted areas within the facilities in all regions
across the United States. This system maintains individuals' personal
individual verification (PIV) information to support the USDA's efforts
related to protecting USDA facilities and operating the USDA visitor
management program. Efforts have been made to safeguard records in
accordance with applicable rules and policies, including all applicable
USDA automated systems security and access policies. Strict controls
have been imposed to minimize the risk of compromising the information
that is being stored. Access to the computer system containing the
records in this system is limited to those individuals who have a need
to know the information for the performance of their official duties
and who have appropriate clearances or permissions.
SYSTEM NAME AND NUMBER:
USDA/OSSP-1, Enterprise Physical Access Control System (ePACS)
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
The ePACS is maintained and physically located at USDA's Digital
Infrastructure Services Center at 8930 Ward Parkway, Kansas City,
Missouri 64114.
SYSTEM MANAGER(S):
Director, Facility Protection Division, Office of Safety, Security,
and Protection,1400 Independence Avenue SW, Washington, DC 20250, (202)
260-8930.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
Homeland Security Presidential Directive-12 (HSPD-12), Departmental
Physical Security Program, DR 1650-001, December 9, 2021, and Authority
to Operate (ATO), 06/07/2022.
PURPOSE(S) OF THE SYSTEM:
The ePACS provides a centralized infrastructure for the use of the
USDA standard personal individual verification (PIV) card for access to
federally controlled facilities as mandated by HSPD-12. The ePACS
provides a means for USDA Agencies to deploy electronic access control
to its facilities; supports the mitigation of identified threats and
vulnerabilities; and ensures that unauthorized individuals do not have
access to critical USDA assets. Incorporated into ePACS is the Visitor
Management System (VMS), which allows visitors to log into a website
and request to visit USDA locations where VMS is implemented.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
Categories of individuals covered by this system include
individuals with electronic facility physical access credentials
including USDA employees, contractor employees, building
[[Page 36273]]
occupants, interns, visitors, and volunteers.
CATEGORIES OF RECORDS IN THE SYSTEM:
Categories of records in the system consists of records created for
individuals to obtain electronic facility access credentials as well as
temporary badges for facility access. The ePACS generally handles
physical access security management information including physical
access card status, physical access card category, physical access card
expiration date, and physical access card holder emergency response
responsibilities.
The data stored in ePACS includes: Federal Agency Smart Credential
Number (FASC-N), Card Category, Card Status, Card Expiration Date,
Photo, First Name, Middle Name, Last Name, Employee type, Employee
Status, Emergency Responder, Department, Agency, Sub-agency, City,
State, date of birth, and entry and exit date and time.
RECORD SOURCE CATEGORIES:
Information in this system is obtained from an official Department
information technology system and is loaded into the system of records
from the following source system: the Department's system of records
entitled USDA/OCIO-2, eAuthentication Service--71 FR 42346--July 26,
2006, USDA/OCIO-2, eAuthentication Service (eAuth)--77 FR 15024--March
14, 2012, USDA/OCIO-2 eAuthentication Service--82 FR 8503--January 26,
2017.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND PURPOSES OF SUCH USES:
In addition to those disclosures generally permitted under 5 U.S.C.
552a(b) of the Privacy Act of 1974, records contained in this system
may be disclosed outside USDA as a routine use pursuant to 5 U.S.C.
552a(b)(3), to the extent that such uses are compatible with the
purposes for which the information was collected. Such permitted
routine uses include the following:
A. To the Department of Justice (DOJ) when: (a) USDA or any
component thereof; or (b) any employee of USDA in his or her official
capacity where the Department of Justice has agreed to represent the
employee; or (c) the United States Government, is a party to litigation
or has an interest in such litigation, and USDA determines that the
records are both relevant and necessary to the litigation and the use
of such records by the Department of Justice is deemed by USDA to be
for a purpose that is compatible with the purpose for which USDA
collected the records.
B. To a Congressional Office in response to an inquiry from that
Congressional Office made at the written request of the individual
about whom the record pertains.
C. To the National Archives and Records Administration (NARA) or
other Federal Government agencies pursuant to records management
activities being conducted under 44 U.S.C. 2904 and 2906.
To appropriate agencies, entities, and persons when (1) USDA
suspects or has confirmed that the security or confidentiality of
information in the system of records has been compromised; (2) USDA has
determined that as a result of the suspected or confirmed breach, there
is a risk of harm to individuals, USDA (including its information
systems, programs, and operations), the Federal Government, or national
security; and (3) the disclosure to such agencies, entities, and
persons is reasonably necessary to assist in connection with USDA's
efforts to respond to the suspected or confirmed compromise and
prevent, minimize, or remedy such harm; or to another Federal agency or
Federal entity, when information from this system of records is
reasonably necessary to assist the recipient agency or entity in (1)
responding to a suspected or confirmed breach; or (2) preventing,
minimizing, or remedying the risk of harm to individuals, the agency
(including its information systems, programs, and operations), the
Federal Government, or national security.
When a record on its face, or in conjunction with other records,
indicates a violation or potential violation of law, whether civil,
criminal or regulatory in nature, and whether arising by general
statute or particular program, statute, or by regulation, rule, or
order issued pursuant thereto, disclosure may be made to the
appropriate Federal, State, local, foreign, Tribal, or other public
authority responsible for enforcing, investigating, or prosecuting such
violation or charged with enforcing or implementing the statute, or
rule, regulation, or order issued pursuant thereto, if the information
disclosed is relevant to any enforcement, regulatory, investigative or
prosecutive responsibility of the receiving entity. Referral to the
appropriate agency, whether Federal, State, local, or foreign, charged
with the responsibility of investigating or prosecuting violation of
law, or of enforcing or implementing a statute, rule, regulation, or
order issued pursuant thereto, of any record within this system when
information available indicates a violation or potential violation of
law, whether civil, criminal, or regulatory in nature.
D. To a court or adjudicative body in a proceeding when: (a) USDA
or any component thereof; or (b) any employee of USDA in his or her
official capacity; or (c) any employee of USDA in his or her individual
capacity where USDA has agreed to represent the employee; or the United
States Government is a party to litigation or has an interest in such
litigation, and USDA determines that the records are both relevant and
necessary to the litigation, and that use of such records is therefore
deemed by USDA to be for a purpose that is compatible with the purpose
for which USDA collected the records.
To contractors and their agents, grantees, experts, consultants,
and others performing or working on a contract, service, grant,
cooperative agreement, or other assignment for the USDA, when necessary
to accomplish an agency function related to this system of records.
Individuals providing information under this routine use are subject to
the same Privacy Act requirements and limitations on disclosure as are
applicable to USDA officers and employees.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Records are stored on encrypted servers within a secured and
controlled environment. Records backup storage is maintained by the
USDA's Digital Infrastructure Services Center (DISC) in a virtual tape
library at the USDA's DISC facility in Kansas City, MO. Copies of the
backup records are maintained at the USDA DISC facility in St. Louis,
MO. The ePACS has no hardcopy paper records that require storage.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records are retrieved by a combination of name and date range.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Records compiled under this SORN will be maintained in accordance
with NARA General Records Schedule (GRS) Transmittal 32 issued March
2022, Items 110 and 120, and NARA records retention schedules DAA-
GRS2017-0006-0014, and DAA-GRS2021-0001-0005, to the extent applicable.
Records may be retained for a longer period as required by litigation,
investigation, and/or audit. A master file backup is created at the end
of the calendar year and maintained in St. Louis, Mo. The St. Louis
offsite storage site is located approximately 250 miles from the
primary data facility and is not susceptible to the same hazards.
[[Page 36274]]
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
Records in this system are safeguarded by restricting
accessibility, in accordance with USDA security and access policies.
The safeguarding includes secured severs, firewall(s), network
protection, and an encrypted password. Each user is assigned a level of
role-based access, which is strictly controlled and granted through
USDA-approved, secure application (after the user has successfully
completed the Government National Agency Check with Inquiries (NACI)
investigation).
Physical security measures are in place to prevent unauthorized
persons from accessing ePACS as only government furnished equipment is
allowed. The ePACS users are also required to complete appropriate
training to learn requirements for safeguarding records maintained
under the Privacy Act. USDA's Digital Infrastructure Services Center
(DISC) safeguards records and ensures that privacy requirements are met
in accordance with Federal and cyber security mandates. DISC provides
continuous storage management, encryption, security administration,
regular dataset backups, and contingency planning/disaster recovery.
RECORD ACCESS PROCEDURES:
Individuals seeking to gain access to a record in this system of
records, must contact the system manager at the address listed above
and provide the system manager with the necessary particulars such as
full name, date of birth, work address, country of citizenship.
Requesters must also reasonably specify the record contents sought. The
request must meet the requirements of the regulations at 34 CFR 5b.5,
including proof of identity. All requests for access to records must be
in writing and should be submitted to the system manager at the address
listed above. A determination whether a record may be accessed will be
made at the time a request is received. All inquiries should be
addressed in accordance with the ``Notification Procedures'' below.
CONTESTING RECORD PROCEDURES:
Individuals seeking to contest or amend information maintained in
the system should direct their request to the above listed System
Manager and should include the reason for contesting it and the
proposed amendment to the information with supporting information to
show how the record is inaccurate. A request for contesting records
should contain: Name, address including zip code, name of the system of
records, year of records in question, and any other pertinent
information to help identify the data requested.
NOTIFICATION PROCEDURES:
Any individual may request information regarding this system of
records, or information as to whether the system contains records
pertaining to the individual, from the System Manager listed above: See
RECORD ACCESS PROCEDURES.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
Samuel Willis,
Director--Facility Protection Division, Office of Safety, Security and
Protection, Departmental Administration, United States Department of
Agriculture.
[FR Doc. 2023-11753 Filed 6-1-23; 8:45 am]
BILLING CODE 3410-98-P