Privacy Act of 1974; System of Records, 30040-30045 [2021-11756]

Agencies

• ENVIRONMENTAL PROTECTION AGENCY

[Federal Register Volume 86, Number 106 (Friday, June 4, 2021)]
[Notices]
[Pages 30040-30045]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2021-11756]


-----------------------------------------------------------------------

ENVIRONMENTAL PROTECTION AGENCY

[FRL: 10023-03-OMS]


Privacy Act of 1974; System of Records

AGENCY: Office of Mission Support, Environmental Protection Agency.

ACTION: Notice of a modified system of records.

-----------------------------------------------------------------------

SUMMARY: The U.S. Environmental Protection Agency's Office of Mission 
Support is giving notice that it proposes to modify a system of records 
pursuant to the provisions of the Privacy Act of 1974. The Office of 
Mission Support is modernizing the Debarment and Suspension Files 
system of records by implementing an electronic case management system: 
Case Application for Debarment and Suspension. Case Application for 
Debarment and Suspension is an electronic records management system 
that supports the Environmental Protection Agency in assembling 
information in order to conduct and document discretionary suspension 
and debarment proceedings under the Federal Acquisition Regulation or 
the Non procurement Common Rule (2 CFR part 180), as well as to carry 
out the Environmental Protection Agency's obligations to process 
statutory exclusions under Clean Air Act section 306 and Clean Water 
Act section 508. The Office of Mission Support is accordingly modifying 
its system of records notice EPA-33 in several respects. All other 
exemptions and provisions included in the previously published system 
of records notice for Debarment and Suspension Files will transfer to 
the modified system of records notice for Case Application for 
Debarment and Suspension.

DATES: Persons wishing to comment on this system of records notice must 
do so by July 6, 2021. New or modified routine uses for this modified 
system of records will be effective July 6, 2021.

ADDRESSES: Submit your comments, identified by Docket ID No. EPA-HQ-
OMS-2020-0281, by one of the following methods:
    Regulations.gov: https://www.regulations.gov. Follow the online 
instructions for submitting comments.
    Email: [email protected]. Include the Docket ID number in the 
subject line of the message.
    Fax: 202-566-1752.
    Mail: OMS Docket, Environmental Protection Agency, Mail Code: 
2822T, 1200 Pennsylvania Ave. NW, Washington, DC 20460.
    Hand Delivery: OMS Docket, EPA/DC, WJC West Building, Room 3334, 
1301 Constitution Ave. NW, Washington, DC 20460. Such deliveries are 
only accepted during the Docket's normal hours of operation, and 
special arrangements should be made for deliveries of boxed 
information.
    Instructions: Direct your comments to Docket ID No. EPA-HQ-OMS-
2020-0281. The Environmental Protection Agency's (EPA) policy is that 
all comments received will be included in the public docket without 
change and may be made available online at https://www.regulations.gov, 
including any personal information provided, unless the comment 
includes information claimed to be Controlled Unclassified Information 
(CUI) or other information for which disclosure is restricted by 
statute. Do not submit information that you consider to be CUI or 
otherwise protected through https://www.regulations.gov. The https://www.regulations.gov website is an ``anonymous access'' system for EPA, 
which means the EPA will not know your identity or contact information. 
If you submit an electronic comment, the EPA recommends that you 
include your name and other contact information in the body of your 
comment. If the EPA cannot read your comment due to technical 
difficulties and cannot contact you for clarification, the EPA may not 
be able to consider your comment. If you send an email comment directly 
to the EPA without going through https://www.regulations.gov, your 
email address will be automatically captured and included as part of 
the comment that is placed in the public docket and made available on 
the internet. Electronic files should avoid the use of special 
characters, any form of encryption, and be free of any defects or 
viruses. For additional information about the EPA public docket, visit 
the EPA Docket Center homepage at https://www.epa.gov/dockets.

[[Page 30041]]

    Docket: All documents in the docket are listed in the https://www.regulations.gov index. Although listed in the index, some 
information is not publicly available, e.g., CUI or other information 
for which disclosure is restricted by statute. Certain other material, 
such as copyrighted material, will be publicly available only in hard 
copy. Publicly available docket materials are available either 
electronically in https://www.regulations.gov or in hard copy at the 
OMS Docket, EPA/DC, WJC West Building, Room 3334, 1301 Constitution 
Ave. NW, Washington, DC 20460. The Public Reading Room is normally open 
from 8:30 a.m. to 4:30 p.m., Monday through Friday excluding legal 
holidays. The telephone number for the Public Reading Room is (202) 
566-1744, and the telephone number for the OMS Docket is (202) 566-
1752.

Temporary Hours During COVID-19

    Out of an abundance of caution for members of the public and our 
staff, the EPA Docket Center and Reading Room are closed to the public, 
with limited exceptions, to reduce the risk of transmitting COVID-19. 
Our Docket Center staff will continue to provide remote customer 
service via email, phone, and webform. We encourage the public to 
submit comments via https://www.regulations.gov/ or email, as there may 
be a delay in processing mail and faxes. Hand deliveries and couriers 
may be received by scheduled appointment only. For further information 
on EPA Docket Center services and the current status, please visit us 
online at https://www.epa.gov/dockets.

FOR FURTHER INFORMATION CONTACT: Marcella James, Office of Grants and 
Debarment, Office of Mission Support, Environmental Protection Agency, 
Ronald Reagan Building, Mail Code 3901R, 1300 Pennsylvania Avenue NW, 
Washington, DC 20460; telephone number, (202) 564-2572; email address, 
[email protected].

SUPPLEMENTARY INFORMATION: The Office of Mission Support is 
transitioning from a paper filing system under the Debarment and 
Suspension Files system of records to a new electronic case management 
system, Case Application for Debarment and Suspension (CADS). The EPA 
is accordingly modifying its system of records notice (SORN) EPA-33 in 
several respects.
    First, the Office of Mission Support is updating the system name to 
Case Application for Debarment and Suspension (CADS).
    Second, because all records in CADS are electronic instead of in 
paper form, the system location is modified to the physical location of 
the CADS computer storage devices in the EPA National Computer Center 
(NCC).
    Third, the Office of Mission Support processes suspension and 
debarment case actions under the Federal Acquisition Regulation (FAR) 
Subpart 9.4 (procurement regulations) and 2 CFR part 180 and part 1532 
(nonprocurement regulations). The Office of Mission Support also 
processes statutory exclusions under Clean Air Act section 306 and 
Clean Water Act section 508 and 2 CFR part 1532, subpart J. EPA-33 
already includes individuals subject to suspension and debarment case 
actions under the procurement and nonprocurement regulations, but does 
not include statutory exclusions under Clean Air Act section 306 and 
Clean Water Act section 508. The Office of Mission Support is therefore 
modifying EPA-33 to include individuals subject to a statutory 
exclusion under the Clean Air Act or Clean Water Act as categories of 
individuals covered by the system, and to include statutory exclusion 
records as categories of records in the system and record source 
categories.
    Fourth, the Office of Mission Support is also updating the routine 
uses of records maintained in EPA-33. The Office of Mission Support is 
modifying routine uses 1-5 as follows:
     For routine use 1, updating the exclusion database name to 
the System for Award Management (SAM) to reflect changes made by the 
General Services Administration (GSA) to the name of the exclusion 
list, and updating the nonprocurement regulation citation so that it is 
accurate.
     For routine use 2, adding statutory exclusions as a type 
of suspension and debarment proceeding, and re-numbering routine use 2 
to routine use 3.
     For routine use 3, adding procurement transactions to the 
type of transactions relevant for an individual's eligibility 
determination, updating the nonprocurement regulation citation to 2 CFR 
part 180 and part 1532 because the EPA definition of covered 
transaction was moved from 40 CFR 32.200, and re-numbering routine use 
3 to routine use 6.
     For routine use 4, re-numbering to routine use 7.
     For routine use 5, removing the disclosure of settlement 
agreements from the routine use because settlement agreements are now 
uploaded to the Federal Awardee Performance and Integrity Information 
System (FAPIIS) as discussed in new routine use 2, and re-numbering to 
routine use 8.
    The general routine uses A, B, C, D, E, F, G, H, I, and K continue 
to apply to the system. The Office of Mission Support is adding new 
general routine uses L and M and the following new routine uses:
     A new routine use ``2'' for disclosing records to GSA in 
accordance with Section 872 of The Duncan Hunter National Defense 
Authorization Act of 2009 (Pub. L. 110-417) which requires the public 
disclosure of suspension and debarment administrative agreements in 
FAPIIS.
     A new routine use ``4'' for disclosing records to 
individual respondents and related respondents or the authorized 
representatives of related respondents. A respondent is a person 
against whom a suspension or debarment action has been initiated or may 
be initiated. The Office of Mission Support is adding a new routine use 
4 to disclose records to any individual who is the subject of a 
suspension or debarment case action as an actual or potential 
respondent in a suspension and debarment matter. This routine use 
addresses situations where the Office of Mission Support discloses to a 
respondent his or her own records in a suspension and debarment matter. 
The new routine use 4 is also adding the disclosure of records to 
related respondents and authorized representatives of related 
respondents. This routine use addresses situations where the Office of 
Mission Support initiates a case action where individuals or other 
persons are involved in the same misconduct that is the action basis 
for the suspension or debarment matter and the records are disclosed to 
all the respondents in order to give them notice and an opportunity to 
respond to the suspension or debarment action. The Office of Mission 
Support proposes to disclose records to related respondents or their 
authorized representatives only when by careful review the Agency 
determines that the records are both relevant and necessary to the 
related respondent's suspension or debarment proceeding.
     A new routine use ``5'' for disclosing records to other 
federal agencies coordinating with the EPA in suspension and debarment 
case actions. The Office of Mission Support participates in a 
government-wide system for debarment and suspension from programs and 
activities involving federal financial and nonfinancial assistance and 
benefits. Because suspension and debarment actions have governmentwide 
effect, the Office of Mission Support engages in a lead agency 
coordination process when using a suspension or debarment remedy.

[[Page 30042]]

    Fifth, the Office of Mission Support is modifying the policies and 
practices for storage, retrieval, and retention and disposal of records 
to describe those that apply to the use of electronic records in the 
new CADS system.
    Sixth, the Office of Mission Support is modifying the 
administrative, technical, and physical safeguards to describe those 
that apply to the management of electronic records in the new CADS 
system.
    Lastly, the Office of Mission Support is adding authorities for the 
maintenance of the system to include those relevant to electronic 
recordkeeping and to add relevant suspension and debarment regulations.
    All other elements of EPA-33 will transfer to the modified system 
of records notice for Case Application for Debarment and Suspension. 
The system continues to be maintained by the Office of Mission Support, 
previously known as the Office of Administration and Resource 
Management.

SYSTEM NAME AND NUMBER:
    Case Application for Debarment and Suspension, EPA-33

SECURITY CLASSIFICATION:
    Unclassified.

SYSTEM LOCATION:
    National Computer Center (NCC), 109 TW Alexander Drive, Research 
Triangle Park, Durham, NC 27711.

SYSTEM MANAGER(S):
    Michael Osinski, Director, Office of Grants and Debarment, Office 
of Mission Support, Environmental Protection Agency, Ronald Reagan 
Building, Mailcode 3901R, 1300 Pennsylvania Avenue NW, Washington, DC 
20460; telephone number, (202) 564-3792; email address, 
[email protected].

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Government Paperwork Elimination Act (Pub. L. 105-277, 44 U.S.C. 
3504); 33 U.S.C. 1368; 42 U.S.C. 7606; Executive Order 11738, Providing 
for administration of the Clean Air Act and the Federal Water Pollution 
Control Act with respect to Federal contracts, grants, or loans (38 FR 
25161, 3 CFR, 1971-1975 Comp., p. 799); Executive Order 12549, 
Debarment and Suspension (51 FR 6370, 3 CFR, 1986 Comp., p. 189); 
Executive Order 12689 (54 FR 34131, 3 CFR, 1989 Comp., p. 235); the 
Federal Acquisition Streamlining Act of 1994, Public Law 103-355, 31 
U.S.C. 6101 note; 2 CFR part 180--the Office of Management and Budget 
Guidelines to Agencies on Governmentwide Debarment and Suspension 
(Nonprocurement); 2 CFR part 1532--Nonprocurement Debarment and 
Suspension; and the Federal Acquisition Regulation, 48 CFR subpart 
9.4--Debarment, Suspension, and Ineligibility.

PURPOSE(S) OF THE SYSTEM:
    The purpose of CADS is to assist the Office of Mission Support in 
processing, investigating, and maintaining records relevant to 
suspension and debarment case actions. The Office of Mission Support 
utilizes suspension and debarment as an administrative tool to address 
waste, fraud, abuse, poor performance, environmental noncompliance or 
other misconduct by excluding individuals from participating in federal 
procurement or nonprocurement programs. The Office of Mission Support 
is also responsible for implementing a statutory debarment authority 
that arises by operation of law under the Clean Air Act section 306 or 
Clean Water Act section 508. This statutory debarment authority 
prohibits the Federal Government from entering into contracts or 
nonprocurement transactions at violating facilities unless and until 
the EPA Suspension and Debarment Official can certify that the 
conditions that gave rise to the Clean Air Act or Clean Water Act 
conviction have been corrected. This system of records also assists the 
Office of Mission Support in assembling information in order to conduct 
and document suspension and debarment proceedings; to ensure that 
federal contracts and federal assistance, loans, and benefits are 
awarded to responsible business entities and individuals; and to ensure 
the government conducts business with persons at facilities that are in 
compliance with the Clean Air Act or Clean Water Act.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    (1) Individuals who have been suspended, proposed for debarment, or 
debarred from federal procurement and assistance programs; (2) 
Individuals who have been the subject of agency inquiries to determine 
whether they should be debarred and/or suspended from federal 
procurement and assistance programs; and (3) Individuals who have been 
convicted and are subject to an exclusion by operation of law under 
Clean Air Act section 306 or Clean Water Act section 508.

CATEGORIES OF RECORDS IN THE SYSTEM:
    Records include information on individuals and firms excluded or 
considered for exclusion from federal acquisition or assistance 
programs as a result of suspension or debarment proceedings initiated 
by the EPA, or as a result of a statutory exclusion arising by 
operation of law upon conviction pursuant to Clean Air Act section 306 
or Clean Water Act section 508. Such information includes, but is not 
limited to, names and residential addresses of individuals; email 
addresses of individuals; business addresses associated with 
individuals; phone numbers associated with individuals; evidence 
obtained in support of suspension and debarment case actions; records 
submitted by individuals or other persons (corporations, partnerships, 
associations, unit of governments, or legal entities, however 
organized, or their authorized representative); administrative 
agreements; audits of administrative agreements; and final decisions or 
reinstatement determinations. Examples of records include 
correspondence, inspection reports, memoranda of interviews, contracts, 
assistance agreements, indictments, judgment and conviction orders, 
plea agreements, and corporate information. Records such as court 
documents or reports from commercial databases may contain individuals' 
Social Security Numbers and dates of birth. Computer generated records 
include data and reports regarding categories and status of cases.

RECORD SOURCE CATEGORIES:
    EPA and other federal officials, state and local officials, 
businesses and other entities who may have information relevant to an 
inquiry, individuals who have been statutorily excluded, suspended, 
proposed for debarment or debarred, and their authorized 
representatives.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND PURPOSES OF SUCH USES:
    The following routine uses apply to this system because the use of 
the record is necessary for the efficient conduct of government 
operations. The routine uses below are both related to and compatible 
with the original purpose for which the information was collected. The 
following general routine uses apply to this system (73 FR 2245):
    A. Disclosure for Law Enforcement Purposes: Information may be 
disclosed to the appropriate federal, state, local, tribal, or foreign 
agency responsible for investigating, prosecuting, enforcing, or 
implementing a statute, rule, regulation, or order, if the information 
is relevant to a violation or potential violation of civil or criminal 
law or regulation within the jurisdiction of the receiving entity.

[[Page 30043]]

    B. Disclosure Incident to Requesting Information: Information may 
be disclosed to any source from which additional information is 
requested (to the extent necessary to identify the individual, inform 
the source of the purpose of the request, and to identify the type of 
information requested,) when necessary to obtain information relevant 
to an agency decision concerning retention of an employee or other 
personnel action (other than hiring,) retention of a security 
clearance, the letting of a contract, or the issuance or retention of a 
grant, or other benefit.
    C. Disclosure to Requesting Agency: Disclosure may be made to a 
federal, state, local, foreign, or tribal or other public authority of 
the fact that this system of records contains information relevant to 
the retention of an employee, the retention of a security clearance, 
the letting of a contract, or the issuance or retention of a license, 
grant, or other benefit. The other agency or licensing organization may 
then make a request supported by the written consent of the individual 
for the entire record if it so chooses. No disclosure will be made 
unless the information has been determined to be sufficiently reliable 
to support a referral to another office within the agency or to another 
federal agency for criminal, civil, administrative, personnel, or 
regulatory action.
    D. Disclosure to Office of Management and Budget: Information may 
be disclosed to the Office of Management and Budget at any stage in the 
legislative coordination and clearance process in connection with 
private relief legislation as set forth in OMB Circular No. A-19.
    E. Disclosure to Congressional Offices: Information may be 
disclosed to a congressional office from the record of an individual in 
response to an inquiry from the congressional office made at the 
request of the individual.
    F. Disclosure to Department of Justice: Information may be 
disclosed to the Department of Justice, or in a proceeding before a 
court, adjudicative body, or other administrative body before which the 
Agency is authorized to appear, when:
    1. The Agency, or any component thereof;
    2. Any employee of the Agency in his or her official capacity;
    3. Any employee of the Agency in his or her individual capacity 
where the Department of Justice or the Agency have agreed to represent 
the employee; or
    4. The United States, if the Agency determines that litigation is 
likely to affect the Agency or any of its components, is a party to 
litigation or has an interest in such litigation, and the use of such 
records by the Department of Justice or the Agency is deemed by the 
Agency to be relevant and necessary to the litigation provided, 
however, that in each case it has been determined that the disclosure 
is compatible with the purpose for which the records were collected.
    G. Disclosure to the National Archives: Information may be 
disclosed to the National Archives and Records Administration in 
records management inspections.
    H. Disclosure to Contractors, Grantees, and Others: Information may 
be disclosed to contractors, grantees, consultants, or volunteers 
performing or working on a contract, service, grant, cooperative 
agreement, job, or other activity for the Agency and who have a need to 
have access to the information in the performance of their duties or 
activities for the Agency. When appropriate, recipients will be 
required to comply with the requirements of the Privacy Act of 1974 as 
provided in 5 U.S.C. 552a(m).
    I. Disclosures for Administrative Claims, Complaints and Appeals: 
Information from this system of records may be disclosed to an 
authorized appeal grievance examiner, formal complaints examiner, equal 
employment opportunity investigator, arbitrator or other person 
properly engaged in investigation or settlement of an administrative 
grievance, complaint, claim, or appeal filed by an employee, but only 
to the extent that the information is relevant and necessary to the 
proceeding. Agencies that may obtain information under this routine use 
include, but are not limited to, the Office of Personnel Management, 
Office of Special Counsel, Merit Systems Protection Board, Federal 
Labor Relations Authority, Equal Employment Opportunity Commission, and 
Office of Government Ethics.
    K. Disclosure in Connection With Litigation: Information from this 
system of records may be disclosed in connection with litigation or 
settlement discussions regarding claims by or against the Agency, 
including public filing with a court, to the extent that disclosure of 
the information is relevant and necessary to the litigation or 
discussions and except where court orders are otherwise required under 
section (b)(11) of the Privacy Act of 1974, 5 U.S.C. 552a(b)(11).
    The two routine uses below (L and M) are required by OMB Memorandum 
M-17-12:
    L. Disclosure to Persons or Entities in Response to an Actual or 
Suspected Breach of Personally Identifiable Information: To appropriate 
agencies, entities, and persons when (1) the Agency suspects or has 
confirmed that there has been a breach of the system of records, (2) 
the Agency has determined that as a result of the suspected or 
confirmed breach there is a risk of harm to individuals, the Agency 
(including its information systems, programs, and operations), the 
Federal Government, or national security; and (3) the disclosure made 
to such agencies, entities, and persons is reasonably necessary to 
assist in connection with the Agency's efforts to respond to the 
suspected or confirmed breach or to prevent, minimize, or remedy such 
harm.
    M. Disclosure to Assist Another Agency in Its Efforts to Respond to 
a Breach of Personally Identifiable Information: To another federal 
agency or federal entity, when the Agency determines that information 
from this system of records is reasonably necessary to assist the 
recipient agency or entity in (1) responding to a suspected or 
confirmed breach or (2) preventing, minimizing, or remedying the risk 
of harm to individuals, the recipient agency or entity (including its 
information systems, programs, and operations), the Federal Government, 
or national security, resulting from a suspected or confirmed breach.
    Records may also be disclosed:
    1. Disclosure to the System for Award Management: To the General 
Services Administration (GSA) to compile and maintain the System for 
Award Management (SAM) Exclusions list in accordance with FAR 9.404 and 
2 CFR 180.500 and 180.505.
    2. Disclosure to the Federal Awardee Performance and Integrity 
Information System: To the GSA for the Federal Awardee Performance and 
Integrity Information System (FAPIIS), which publicly discloses 
administrative agreements as required by Section 872 of The Duncan 
Hunter National Defense Authorization Act of 2009 (Pub. L. 110-417).
    3. Disclosure to the Individual Respondent: To the individual 
person statutorily excluded, suspended, proposed for debarment, or 
debarred in EPA proceedings; to the individual person who has been the 
subject of agency inquiries to determine whether the individual person 
should be debarred and/or suspended from federal procurement and 
assistance programs; and to the authorized representatives of the 
individual person statutorily excluded, suspended, proposed for 
debarment or debarred in EPA proceedings.

[[Page 30044]]

    4. Disclosure to Other Respondents: To persons (any individual, 
corporation, partnership, association, unit of government, or legal 
entity, however organized) who have been suspended, proposed for 
debarment, or debarred from federal procurement and assistance 
programs; persons who have been the subject of agency inquiries to 
determine whether they should be debarred and/or suspended from federal 
procurement and assistance programs; and to the authorized 
representatives of the persons in a suspension or debarment proceeding, 
when by careful review the Agency determines that the records are both 
relevant and necessary to the persons' suspension or debarment 
proceedings.
    5. Disclosure to Coordinating Federal Agencies: To a federal agency 
coordinating with the EPA for an EPA suspension or debarment proceeding 
or having a suspension or debarment action involving the same person.
    6. Disclosure for Eligibility Determinations: To a federal, state, 
or local agency, financial institution, or other entity to verify an 
individual's eligibility for engaging in federal procurement 
transactions or covered transactions as defined in FAR Subpart 9.4 and 
2 CFR part 180.
    7. Disclosure to Requesting Agencies for Particular Purposes: To 
federal, state, or local agencies, in response to requests or 
subpoenas, or otherwise, for the purpose(s) of: (a) Assisting them in 
administering federal acquisition, assistance, loan and benefit 
programs or regulatory programs, (b) assisting them in discharging 
their duties to ensure that federal contracts and assistance, loans, 
and benefit programs are awarded to responsible individuals and 
organizations, and (c) ensuring that federal, state or local regulatory 
responsibilities are met.
    8. Disclosure of Final Decisions: To the public, upon request, and 
to publishers of computerized legal research systems, but such 
disclosures shall be limited to interim or final decisions.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
    The information collected within CADS is maintained and stored on 
computer storage devices physically located at NCC. These records are 
maintained electronically on computer storage devices such as computer 
tapes and disks. Backups will be maintained at a disaster recovery 
site. Computer records are maintained in a secure password protected 
environment. Access to computer records is limited to those who have a 
need to know. Permission level assignments will allow users access only 
to those functions for which they are authorized. All records are 
maintained in secure, access-controlled areas or buildings.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
    Records are retrieved by business or organization name, by an 
individual's first or last name, by case number, or by file name.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
    Records are retained in accordance with the EPA's Records Schedules 
1016(c) and 0090(d) and disposed of under National Archives and Records 
Administration (NARA) disposal authority DAA-0412-2013-0015-0003.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
    Security controls used to protect personal sensitive data in CADS 
are commensurate with those required for an information system rated 
MODERATE for confidentiality, integrity, and availability, as 
prescribed in National Institute of Standards and Technology (NIST) 
Special Publication, 800-53, ``Security and Privacy Controls for 
Federal Information Systems and Organizations,'' Revision 5.
    1. Administrative Safeguards: Personnel are instructed to lock 
their computer when they leave their desks. Personnel receive annual 
Information Security and Privacy Awareness training and are regularly 
reminded about appropriate personally identifiable information handling 
procedures. In addition to the Agency's Rules of Behavior and Privacy 
Act training that personnel undergo, CADS users are required to sign a 
Rules of Behavior document and a Request for Remote Access and Use of 
Sensitive Personally Identifiable Information document before they are 
granted access to CADS.
    2. Technical Safeguards: Access to CADS is strictly controlled and 
is limited to those with an operational need to access the information. 
Access is granted and managed by CADS Administrators. Access to the EPA 
Virtual Private Network requires two-factor authentication accomplished 
by using Personal Identity Verification (PIV) cards that are issued to 
all personnel based on the requirements of Homeland Security 
Presidential Directive 12 (HSPD 12). Access to CADS is restricted to 
users on the EPA Virtual Private Network who have been granted 
permission by a CADS administrator to have access to CADS. CADS access 
is username and password protected.
    3. Physical Safeguards: EPA employees and contractors involved in 
the management, design, development, implementation and execution of 
CADS will have monitored access to CADS. Only individuals who have the 
proper authorization and who perform functions related to CADS are 
allowed to access any information. Entry to the EPA facility and within 
the facility to specific spaces at the NCC is achieved using HSPD-12 
PIV cards on door readers. PIV cards are only issued to personnel who 
have met EPA's initial security screening requirements. Security Guards 
at all entrances confirm that the PIV card is valid, unexpired and 
reflects the identity of the card holder. Entry to the server rooms is 
only available to personnel using their PIV cards on door readers, 
where those personnel have been approved for elevated access (meaning 
they have undergone a more rigorous security screening). The NCC 
maintains an Access Control List to ensure access to server rooms is 
limited to approved personnel only.

RECORD ACCESS PROCEDURES:
    Individuals seeking access to information in this system of records 
about themselves are required to provide adequate identification (e.g., 
driver's license, military identification card, employee badge or 
identification card). Additional identity verification procedures may 
be required, as warranted. Requests must meet the requirements of EPA 
regulations that implement the Privacy Act of 1974, at 40 CFR part 16.

CONTESTING RECORD PROCEDURES:
    Requests for correction or amendment must identify the record to be 
changed and the corrective action sought. Complete EPA Privacy Act 
procedures are described in EPA's Privacy Act regulations at 40 CFR 
part 16.

NOTIFICATION PROCEDURE:
    Individuals who want to know whether this system of records 
contains information about them should make a written request to the 
EPA, Attn: Agency Privacy Officer, MC 2831T, 1200 Pennsylvania Ave. NW, 
Washington, DC 20460, [email protected].

EXEMPTIONS PROMULGATED FOR THE SYSTEM:
    None.

HISTORY:
    60 FR 51791 (October 3, 1995)--Creation of the ``Debarment and 
Suspension Files'' system of records.

[[Page 30045]]

    67 FR 8246 (February 22, 2002)--Republication of Existing System of 
Records.

Vaughn Noga,
Senior Agency Official for Privacy.
[FR Doc. 2021-11756 Filed 6-3-21; 8:45 am]
BILLING CODE 6560-50-P