Master Data Management Services (MDMS) System
Total Page:16
File Type:pdf, Size:1020Kb
ADAMS ML19121A465 U.S. Nuclear Regulatory Commission Privacy Impact Assessment Designed to collect the information necessary to make relevant determinations regarding the applicability of the Privacy Act, the Paperwork Reduction Act information collection requirements, and records management requirements. Master Data Management Services (MDMS) System Date: April 16, 2019 A. GENERAL SYSTEM INFORMATION 1. Provide a detailed description of the system: The Nuclear Regulatory Commission (NRC) has established the Master Data Management Services (MDMS) system to address both short and long-term enterprise data management needs. The MDMS is a major agencywide initiative to support the processes and decisions of NRC through: • Improving data quality • Improving re-use and exchange of information • Reducing or eliminating the storage of duplicate information • Providing an enterprise-wide foundation for information sharing • Establishing a data governance structure The MDMS provides an overall vision for, and leadership focused on, an enterprise solution that establishes authoritative data owners, delivers quality data in an efficient manner to the systems that require it, and effectively meets business needs. The MDMS is also focused on data architecture and includes projects that will identify and define data elements across the agency. The MDMS system is a web-based application accessible to representatives from every NRC office—that provides standardized and validated dockets and data records that support dockets, including licenses, contact and billing information, to all downstream NRC systems that require that data. The NRC collects digital identification data for individuals to support the agency core business operations, issue credentials, and administer access to agency‘s physical and logical resources. To support this need, the MDMS system also serves as a centralized repository for the accessibility of organization and personnel data. The MDMS is built on a Master Data Services (MDS) for SQL Server 2012 (also known as Master Data Manager) platform, a Commercial Off- the-Shelf (COTS) product from the Microsoft Corporation that is used by NRC administrators to maintain the data model and data entities that comprise MDMS and support its operations. 1 MDMS resides on the BASS General Support System (EA 20070047) operated by the Office of the Chief Information Officer (OCIO). In general, the support services provided to the MDMS by Business Application Support System (BASS) for operations and compliance with relevant security controls is the same for other applications in the BASS environment 2. What agency function does it support? The MDMS system is the authoritative source for dockets, docket contact and docket licensee information. MDMS receives dockets information created under 10 CFR Parts 30, 40, 70, 71, 72, 110 and 150 from the Web Based Licensing (WBL) system on a nightly basis. The MDMS is also the source of creation for all new power reactor (050, 052) and vendor / non-vendor (999) dockets. In addition, MDMS passes Employee and Organization data received from Enterprise Information Hub (EIH) and Federal Personnel/Payroll System (FPPS), respectively, to subscriber systems. MDMS data is provided to the following subscriber systems: . Replacement Reactor Program System (R-RPS) . Enforcement Action Tracking System (EATS) . Allegation Management System (AMS) . Case Management System (CMS) . Agencywide Documents Access and Management Systems (ADAMS) . Electronic Information Exchange (EIE) System . Cost Activity Code System (CACS) . Financial Accounting and Integrated Management Information System (FAIMIS) . Public Meeting Notice System (PMNS) . System of Ticketing and Reporting (STAR) . Headquarters Operations Officer Database (HOO DB) 3. Describe any modules or subsystems, where relevant, and their functions. N/A 4. What legal authority authorizes the purchase or development of this system? The collection of billing data is required in order to recover fees in accordance with OBRA-90. 10 CFR 15 Debt Collection Procedures touches on billing data. For the collection and maintenance of Tax Identification Number (TIN) (Employee Identification Number or Social Security Number) data in MDMS: The Debt Collection Improvement Act 1996 (Public Law 104-134) “The head of each Federal agency shall require each person doing business with that agency to furnish to that agency such person’s taxpayer identifying number”. 2 5. What is the purpose of the system and the data to be collected? MDMS is used by representatives from every NRC office to access—and with specific permissions to generate—standardized and validated dockets and data records that support dockets, including license and billing information. MDMS has been modified to also store the Taxpayer Identification Number (TIN) of docket licensees as part of the billing information. In addition, MDMS also stores the employee/contractor data from the agency’s Enterprise Identify Hub (EIH) system and organization data from the Federal Personnel/Payroll System (FPPS) and provides the same source data downstream to multiple NRC information systems to support their business functions. 6. Points of Contact: Program Manager Office/Division/Branch Telephone Melissa Ash OCIO/GEMSD 301 415 7251 Project Manager Office/Division/Branch Telephone Sandra Valencia OCIO/GEMSD 301 415 8701 Technical Lead Office/Division/Branch Telephone Jun Lee OCIO/GEMSD/COEAB 301 415 1337 Executive Sponsor Office/Division/Branch Telephone John Moses OCIO/GEMSD 301-415-1276 7. Does this privacy impact assessment (PIA) support a proposed new system or a proposed modification to an existing system? a. New System X Modify Existing System Other (Explain) b. If modifying an existing system, has a PIA been prepared before? Yes (1) If yes, provide the date approved and ADAMS accession number. December 21, 2017, ML17341A289 (2) If yes, provide a summary of modifications to the existing system. The following areas of MDMS are being enhanced as part of 3 the MDMS “Redesign” efforts - 1. Architecture (improvised performance, security, availability and maintainability) 2. User Permissions (streamline visibility, accountability and management of MDMS users’ permissions) 3. Usability (improve clarity, consistency, efficiency, responsiveness of the MDMS user interface) B. INFORMATION COLLECTED AND MAINTAINED These questions are intended to define the scope of the information requested as well as the reasons for its collection. Section 1 should be completed only if information is being collected about individuals. Section 2 should be completed for information being collected that is not about individuals. 1. INFORMATION ABOUT INDIVIDUALS a. Does this system maintain information about individuals? YES (1) If yes, identify the group(s) of individuals (e.g., Federal employees, Federal contractors, licensees, general public). Individuals may be Federal employees, Federal contractors or commercial vendors who are NRC’s licensees. (2) IF NO, SKIP TO QUESTION B.2. b. What information is being maintained in the system about an individual (be specific)? NRC Employees / Contractor Data: The MDMS system contains data for both current and past individual NRC employees and contractors supplied through an interface with EIH. The Employee entity has the following fields: Code (10 character unique ID for each digital identity), Name, LAN ID, Email ID, First Name, Middle Name, Last Name, Name Suffix, Status (Active or Inactive), Affiliation (Employee or Contractor), Position, Employee ID, Effective Date, Termination Date and Organization, Region Name, Building, Floor, Location, Entry on Duty Date (EOD). This data is not modifiable in MDMS; any changes made to the data are applied at the source and pushed to MDMS daily. An amalgam of the employee First Name and Last Name is used as the Name for each record in the Employee entity. These Name values are utilized in MDMS to establish points-of-contact for Dockets. Docket contacts are individual records (hereafter “Contact records”) created in MDMS and linked to one or more dockets. Contact records connect the Name value with email, 4 phone and physical address information for that individual. This data is entered and maintained by MDMS users with specific permissions. Contact records are not currently utilized outside of MDMS and are not passed to subscriber systems. Employee data in MDMS is not linked to TINs or other licensee data. NRC Employees’ Organization Data: The MDMS system contains NRC employees’ organization data supplied from the FPPS system via CSV file. The Organization data has the following fields - Code, Organization Name, Organization Abbreviation, Level 1 Abbreviation (Office), Level 2 Abbreviation (Division), Level 3 Abbreviation (Branch), Level 4 Abbreviation (Team), Active (Organization status) Licensees: Required fields are Name (of license holder entity, which could be an individual), Legal Contact Name (person representing license holder entity), and the Street Address, City, could be a State (if U.S.), Country and Zip of that legal contact. Optional information: legal contact phone and email address. The license holder entity will now be required to also provide the TIN associated with the entity. In the case of some small businesses this TIN may actually be the Social Security Number (SSN) of the business owner who is likely named as the legal contact. c. Is information being collected from the subject individual? NO, MDMS does not collect the information directly from