CGRC Privacy Impact Assessment (PIA)

Question 1

Under which U.S. federal law are agencies required to conduct a Privacy Impact Assessment (PIA) before developing or procuring information technology that collects, maintains, or disseminates personally identifiable information (PII)?

Accepted Answer

The E-Government Act of 2002

Answer

Section 208 of the E-Government Act of 2002 specifically mandates PIAs for federal IT systems that collect or use PII. The Privacy Act of 1974 governs records systems but does not require PIAs. FISMA addresses security programs, and the Clinger-Cohen Act addresses IT acquisition and management.

Question 2

What is the MAIN difference between a Privacy Threshold Analysis (PTA) and a full Privacy Impact Assessment (PIA)?

Accepted Answer

A PTA determines whether a system collects PII and whether a full PIA is required, while a PIA provides the comprehensive privacy analysis

Answer

A PTA is a preliminary screening tool that identifies whether a system handles PII at a level that triggers the requirement for a full PIA. If the PTA determines that PII is collected and a PIA threshold is met, the organization proceeds to develop the comprehensive PIA. They are sequential, not interchangeable.

Question 3

Which of the following scenarios would MOST likely require the agency to conduct a new or updated Privacy Impact Assessment?

Accepted Answer

A new module is added to an existing system that begins collecting Social Security Numbers from users

Answer

A new PIA (or update to an existing one) is required when a system undergoes a significant change that creates new privacy risks — such as collecting a new category of PII like Social Security Numbers. Routine patches, backup policy changes, and personnel changes do not constitute PIA-triggering system changes.

Question 4

According to OMB guidance, which of the following must be TRUE about a completed PIA for a federal system?

Accepted Answer

It must be made publicly available on the agency's website unless the system is national security-related

Answer

OMB guidance requires agencies to make PIAs publicly available, typically on their official websites, to promote transparency about how the government handles personal information. Exceptions exist for national security systems or where disclosure would reveal sensitive information. PIAs are not classified, DHS-reviewed, or submitted to Congress.

Question 5

A federal system that maintains a group of records about individuals retrievable by a personal identifier (such as name or SSN) is BEST described as which of the following?

Accepted Answer

A System of Records (SOR) subject to the Privacy Act

Answer

Under the Privacy Act of 1974, a System of Records (SOR) is defined as a group of records under agency control from which information is retrieved by the name of an individual or by an identifying number, symbol, or other identifier. Systems of Records require a System of Records Notice (SORN) published in the Federal Register.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Privacy Impact Assessment (PIA)