Privacy Impact Assessment
for the

Office of the Chief Human Capital Officer
Talent Acquisition
DHS Reference No. DHS/ALL/PIA-043(a)
September 11, 2020

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 1

Abstract
Talent Acquisition is a Federal Human Capital Business Function whereby federal agencies
establish internal programs and procedures for attracting, recruiting, assessing, and selecting
employees with the right skills and competencies in accordance with federal merit system
principles. Talent Acquisition includes aligning workforce plans to organizational strategies and
business needs, recruiting qualified individuals, evaluating candidates, processing suitability
determinations, and integrating new employees into the Department. The Department of Homeland
Security (DHS) Office of the Chief Human Capital Officer (OCHCO) and DHS Component
Human Capital Offices rely on various systems to support Talent Acquisition processes. DHS is
conducting this Privacy Impact Assessment (PIA), which updates and replaces the previous DHS
Hiring and On-Boarding PIA, because the systems that support Talent Acquisition collect, use,
store, and transmit personally identifiable information (PII) and sensitive personally identifiable
information (SPII).

Overview
DHS has a vital mission to ensure a homeland that is safe, secure, and resilient against
terrorism, natural disasters, and other hazards. This requires the dedication of more than 240,000
employees in jobs that range from border security to emergency response and from cybersecurity
analysts to chemical facility inspectors. To hire and retain a qualified and dedicated workforce, the
Department relies on OCHCO and its Component Human Capital Offices to conduct all
recruitment, hiring, onboarding, and career process-related activities. This includes developing
workforce plans and strategies, creating staffing positions that align with these plans and strategies,
developing and posting job announcements, developing and using online and proctored assessment
tools to evaluate candidates, producing certificates of referral for hiring managers, processing
suitability determinations, extending tentative and final job offers to new employees, and
processing new-hires into the Department. Each DHS Component has its own human resources
(HR) office that recruits and hires for its Component workforce, with OCHCO serving as the HR
office for DHS Headquarters.
OCHCO is leading an ongoing effort to standardize the way the various DHS Component
HR offices conduct Talent Acquisition in accordance with the Office of Personnel Management’s
(OPM) Human Capital Business Reference Model (HCBRM). 1 This entails consulting all of the
Human Capital Business Functions comprise the HCBRM, which is a model for federal agencies that defines the
end-to-end lifecycle of Federal Government Human Capital Management (HCM). The model is used to streamline
government-wide HR operations, standardize HR service delivery, simplify HR acquisitions, and drive transparency
in the federal budget. OPM categorizes Talent Acquisition in its Human Capital Business Reference Model as
Function A2. For more information regarding OPM’s HCBRM, and A2 specifically, see U.S. OFFICE OF PERSONNEL
MANAGEMENT, FEDERAL HUMAN CAPITAL BUSINESS REFERENCE MODEL (HCBRM),
1

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 2

Component Human Capital Offices to identify the systems and processes they currently rely on to
conduct their business, and then working with them to select those systems and processes that are
best suited to expand enterprise-wide. 2 This PIA describes the new enterprise workflow for
conducting Talent Acquisition at DHS and the systems that support it. 3 Specific information
technology (IT) systems used by individual DHS Components that choose not to join all or part of
the new enterprise workflow are detailed in the Appendix.
Hiring Authority
All HR offices within DHS must comply with OPM regulations regardless of whether their
Component chooses to adopt all or part of the new DHS-wide Talent Acquisition workflow. Under
5 U.S.C. § 1104, OPM has delegated to agencies the authority to conduct competitive hiring for
positions in the federal service. DHS hiring authorities have two fundamental responsibilities
under OPM’s delegation: 1) to ensure the agency’s vacant positions are filled with the bestqualified persons from a sufficient pool of well-qualified eligible candidates, 4 and 2) to uphold the
laws, regulations, and policies of merit selection as defined in 5 U.S.C. §§ 2301 and 2302.
With limited exceptions established in law or executive order, members of the public must
have an opportunity to compete for vacant federal positions. DHS is therefore responsible for
providing public notice of the opportunity to compete by listing job announcements on
USAJOBS.gov. 5 DHS is also responsible for establishing policies and procedures for accepting
and processing applications from all applicants (including status applicants 6) and clearly
specifying filing instructions and conditions in job announcements. These processes and
procedures support the various stages of DHS’s Talent Acquisition function, including candidate
https://www.opm.gov/services-for-agencies/hr-line-of-business/hc-business-reference-model/hc-brm-interactivemodel.pdf.
2
Common criteria used to select one Component’s systems or process over another for enterprise use include how
widely it is already in use by Components, how effective it has been in reducing hiring cycles, how much it costs,
and how secure and reliable it has been.
3
This PIA updates and replaces the previous PIA to account for changes to the Talent Acquisition process and
provide a more accurate description of the overall business function. See U.S. DEPARTMENT OF HOMELAND
SECURITY, PRIVACY IMPACT ASSESSMENT FOR THE DHS HIRING AND ON-BOARDING PROCESS, DHS/ALL/PIA-043
(2013), available at https://www.dhs.gov/privacy-documents-department-wide-programs. The specific systems
listed in this PIA may change as DHS continues to evolve its Human Capital Business Functions. DHS will update
this PIA or provide entries in an Appendix if functionality changes.
4
Certain exceptions to hiring have been established by law and executive order with the intent of rewarding prior
federal service or ensuring a diverse federal workforce. These are discussed further in this PIA.
5
USAJOBS.gov is the federal government’s website for posting civil service job opportunities with federal
agencies. The site is operated by OPM. See U.S. OFFICE OF PERSONNEL MANAGEMENT, PRIVACY IMPACT
ASSESSMENT FOR USAJOBS (2005), available at http://www.opm.gov/privacy/PIAs/USAJOBS.pdf.
6
“Status” or “Competitive Status” means a person’s basic eligibility for assignment (for example, by transfer,
promotion, reassignment, demotion, or reinstatement) to a position in the competitive service without having to
compete with members of the general public in an open competitive examination. Once acquired, status belongs to
the individual, not to the position. See 5 U.S.C. § 3304(a); 5 CFR 212.301.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 3

recruitment, developing and posting vacancy announcements, processing applications submitted
in USAJOBS, evaluating and selecting eligible and qualified candidates, issuing temporary and
permanent offers of employment, conducting pre-employment suitability checks, and onboarding
candidates who accept offers of employment at DHS.
Candidate Recruitment
OCHCO’s Strategic Recruitment Diversity and Inclusion (SRDI) Division designs,
executes, and evaluates Department-wide strategic programs to recruit and retain a diverse
workforce, to promote workplace inclusion, and to sustain leadership commitment and
management accountability for inclusive diversity policies and practices. SRDI also provides
guidance to Components to ensure compliance with regulatory requirements and adequate
diversity recruitment practices.
DHS Components are responsible for collecting detailed information on their respective
recruitment, outreach, and marketing activities and providing this information to SRDI. The
information Components routinely provide to SRDI includes time, date, location, event name,
vendor, costs, target audience, recruiters in attendance, and attendee information. Regarding the
latter, event hosts typically use attendance rosters to collect attendee names and contact
information for future recruitment and follow-up. A Privacy Act Statement appears on the rosters
describing the authority for collection, principal purpose of information collected, and routine uses
for sharing that information; as well as a disclosure explaining that furnishing the information is
completely voluntary and that attendees may opt out of receiving correspondence from DHS at
any time by notifying the sender. A similar message is communicated verbally to attendees at the
beginning of recruitment and outreach events. 7
SRDI also frequently hosts recruitment webinars to allow candidates from remote locations
to learn about job opportunities at DHS, the application process, and any hiring flexibilities
pertinent to them. These webinars are typically marketed via DHS public-facing websites and
promotional materials, at schools and veterans’ organizations, and via other forums likely to attract
classes of applicants DHS is required by law and policy to pursue. To register for a DHS
recruitment webinar, individuals 8 are asked to complete a comprehensive registration survey
designed to collect information to assist DHS with demonstrating that its outreach efforts follow
prescriptive recruitment strategies. The data collected from the survey is also aggregated into
analytics reports and dashboards that support decision making around hosting future recruitment
Components may also have their own recruiting tools and recruitment webinar technology that are described in the
Appendix.
8
Individuals at this phase of the recruitment process usually have not yet submitted applications for open positions
at DHS and are attending the webinar or recruitment event to help determine whether they might be interested in
doing so.
7

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 4

webinars. The recruitment webinar registration survey results are automatically fed into OCHCO’s
Strategic Marketing, Outreach, and Recruitment Engagement (SMORE) tool, where they are
automatically aggregated to produce the data analytics dashboards and reports.
SMORE
SMORE is an in-house application used by SRDI and senior HR executives to measure
and track recruitment activities and to produce dashboards reflecting real-time data analytics and
forecasting for recruitment and hiring. The system is designed to eliminate manual data calls and
manual tracking via spreadsheets, thus significantly reducing staff time that would have been
dedicated to these manual administrative tasks. SMORE currently captures non-PII data pertaining
to all DHS Components’ recruitment activities and engagement. It also tracks certain PII data about
collateral duty recruiters (all of whom are DHS employees) to accurately calculate labor costs and
attendance associated with individual recruitment events. 9
The dashboards and reports generated by SMORE contain graphs and charts that track
recruitment expenses by fiscal year, Component, state, type of forum, and targeted audience;
number of events by Component and type of forum; marketing expenses by Component, fiscal
year, targeted audience, and method of advertisement; and Component participation rates in
webinars. Additionally, OCHCO is working to add some privacy-sensitive functionality that
would facilitate SRDI’s ability to track applicants who have noncompetitive eligibility (NCE) 10 as
they move through the hiring process. The information tracked would be limited to name, email,
phone, and process status. This PII would be collected directly from applicant resumes, which
would be requested at recruitment events of attendees who appear likely to meet NCE
requirements.
Vacancy Announcement Development/Posting
The vacancy announcement process primarily involves hiring managers who recruit,
evaluate, and select candidates for open positions they will supervise, and HR specialists who
implement and ensure compliance with federal and DHS hiring rules and procedures. To begin a
hiring action, a hiring manager first submits a request to fill a position through his or her assigned
The PII collected by SMORE pertaining to recruiters includes name, salary (masked in system), grade and step
(masked in system), hour rate if applicable (masked in system), total salary cost (masked in system), role at
recruitment event, and number of hours spent at event.
10
NCE allows federal agencies to hire eligible candidates outside of the formal competitive job announcement
process and compete for certain federal employment jobs that are only open to federal employees. Examples of
individuals with NCE include current or former federal employees, active duty service members, disabled veterans,
persons with disabilities, and recently returned Peace Corps volunteers. NCEs are typically defined in legislation,
Executive Orders, and OPM regulations. Since the U.S. Government prioritizes hiring these categories of
individuals into the federal service as a matter of public policy, DHS and other agencies typically rely on metrics to
track their success in recruiting and hiring them.
9

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 5

HR specialist. The HR specialist then works with the hiring manager and other HR professionals
to determine the appropriate position classification (title, series, grade level), job qualification
requirements, pay plan (General Schedule or other pay system), and bargaining unit status. 11 Once
these determinations are settled, the HR specialist creates a vacancy announcement in OPM’s USA
Staffing 12 system or DHS’s Commercially Available Staffing Services (CASS), 13 depending on
which system the HR specialist’s Component relies on. 14 Once the HR specialist creates the
announcement, he or she posts it on USAJOBS.
Application Completion/Submission
Applicants typically apply for federal jobs on USAJOBS. To apply, an applicant must first
create a profile in the system, a process that requires the collection of name, address, email, phone,
citizenship status, selective service registration status, highest education obtained, and hiring path
status. 15 Additionally, users are prompted to upload one or more resumes, as well as any supporting
documents they foresee using with regularity in future applications. Once they create their profile,
users may search for job announcements based on various criteria including agency, job series,
grade, location, and salary range. Users may also rely on their profile to save job announcements
of interest and tailor automated jobs searches. Once users identify a vacancy announcement to
which they would like to apply, they are prompted to select one resume from their profile and to
upload whatever supporting documents are specified in the announcement. 16
All the information contained on supporting documents is visible to the HR specialists
conducting the hiring action. A feature in both USA Staffing and CASS permits HR specialists to
allow or deny hiring managers the ability to view specific supporting documents, and HR
A bargaining unit position is a job that is represented by a labor union. More information on federal bargaining
units can be found at https://www.usajobs.gov/Help/faq/job-announcement/bargaining-units.
12
USA Staffing is an OPM shared service for automating staffing and assessment. There are two distinct aspects of
USA Staffing: a public-facing web page for applicants, which they reach by signing in at USAJOBS; and a separate,
interface for the subscribing agencies to perform core HR functions. See U.S. OFFICE OF PERSONNEL MANAGEMENT,
PRIVACY IMPACT ASSESSMENT FOR USA STAFFING (2020), available at https://www.opm.gov/informationmanagement/privacy-policy/privacy-policy/usas-pia.pdf.
13
CASS is a vendor-managed system that provides the design, architecture, configuration, implementation, and
maintenance of an electronic staffing solution. It includes a Personnel Action Request processing tool, an applicant
tracking system, an applicant assessment tool, a performance rating and awards tool, a benefits and retirement
tracking tool, a job classification tool, and a business intelligence and reporting tool.
14
Components who choose to adopt part or all of DHS’s new Talent Acquisition workflow have the option of
relying on USA Staffing or CASS as their onboarding system. Components may also have additional onboarding
systems and tools that are described in the Appendix.
15
Hiring Path Status refers to the different categories to which applicants apply that might make them eligible for
special or advantageous hiring considerations. Examples include U.S. citizens, federal employees, veterans, recent
graduates, and Native Americans.
16
If the applicant has not already uploaded a required supporting document into his or her profile, he or she is
provided an opportunity to add it at the end of the application process. More information on the types of supporting
documents that may be required can be found at https://www.usajobs.gov/Help/faq/application/documents/.
11

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 6

specialists are trained to hide from view any documents that contain SPII and that are unrelated to
the hiring decision, such as Standard Form (SF)-50s (Notification of Personnel Action form) or
disability letters. Typically, HR specialists only allow hiring managers to view applicant resumes,
cover letters, and most recent performance evaluations.
Once applicants acknowledge on USAJOBS they have reviewed the resume and whatever
supporting documents they chose to submit, users are asked to provide demographic information
about themselves and how they heard about the job announcement. Users are informed, however,
that providing this information is optional and will have no bearing on their application. If they
decide not to share this information, users simply check a box indicating they prefer not to answer.
Next, applicants are taken to the occupational assessment portion of USAJOBS, where they
are asked questions related to their eligibility to apply for the position (e.g., time in grade
qualifications, acceptable hiring path condition, 17 geographic location) and their qualifications for
the specific position (e.g., experience, knowledge, skills, professional licenses). These types of
assessment questions are designed by hiring managers and HR professionals at DHS within the
USA Staffing or CASS systems themselves. 18 A small number of job announcements also require
assessments that measure general competencies such as reasoning skills, decision-making ability,
math skills, reading comprehension, interpersonal skills, stress tolerance, and accountability.
These types of general cognitive assessments are designed by personnel subject matter experts at
OPM and supported by another OPM shared service, USA Hire. 19 Regardless of whether an
assessment is general or position-specific, and regardless of whether it is supported by USA
Staffing, CASS, or USA Hire, applicants can review, edit, delete, and update their answers to
assessment questions as desired. This information is automatically saved so that no changes are
lost.

The various hiring path conditions that may be pertinent to a given job announcement are typically defined in law
or executive order with the aim of rewarding prior federal service or ensuring a diverse workforce. Hiring path
conditions for a specific job announcement might include Open to the Public, Federal employees-Competitive
service, Federal employees-Excepted service, Internal to agency, Career transition (CTAP, ICTAP, RPL), Family of
overseas employees, Individuals with a disability, Military spouses, National Guard and Reserves, Native American
and Alaskan Natives, Peace Corps and AmeriCorps VISTA, Senior Executives, Special Authorities, Students,
Recent graduates, and Veterans. More information on hiring paths can be found at
https://www.usajobs.gov/Help/how-to/account/profile/hiring-paths/.
18
For those Components that use CASS, hiring managers can consult with institutional subject matter experts
employed by the vendor that supports the system for help with creating occupational assessments.
19
USA Hire collects candidate assessment information, provided by the job applicant, through USA Staffing and
USAJOBS for employment consideration. It is an assessment option that federal agencies may use in combination
with agency-specific staffing assessment questions. See U.S. OFFICE OF PERSONNEL MANAGEMENT, PRIVACY
IMPACT ASSESSMENT FOR USA HIRE (2018), available at https://www.opm.gov/information-management/privacypolicy/privacy-policy/usa-hire.pdf. Components that choose to use CASS instead of USA Staffing are also provided
access to institutional subject matter experts by the vendor for help with developing general cognitive assessments.
17

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 7

At the end of the occupational assessment portion of the application, users are provided a
final opportunity to review and revise their answers and supporting documentation. When
submitting their application in the system, users are asked to certify the information they provided
is true, complete, and made in good faith. Upon submission, an automated email is sent to the
applicant with information and advice about the application process. 20 Users may revise their
application at any time up until midnight of the day the job announcement closes. This date is
prominently displayed on the USAJOBS announcement itself.
Candidate Evaluation/Selection
The HR specialists review applications in USA Staffing or CASS based on answers to the
eligibility and job qualification questions submitted by applicants through USAJOBS. HR
specialists first review the applicant’s answers to eligibility questions and relevant supporting
documentation to confirm satisfaction of hiring time, grade, series, at least one required hiring path
condition, and other eligibility criteria specified in the job announcement. Assuming the HR
specialists determine the applicant has satisfied all eligibility requirements, they then review the
resume, answers to the online assessment questions, and any other pertinent application materials
to determine whether the applicant is qualified based on requisite knowledge, skills, and abilities
needed to perform the duties listed in the job announcement. Once the HR specialists determine
which applicants are both eligible and qualified, they record this information in USA Staffing or
CASS along with the basis for the determinations. USA Staffing or CASS then sends an email
notification to each applicant indicating whether he or she was referred to the hiring manager for
the position, and if not, the basis for the non-referral. 21
HR specialists next generate certificates of eligible (certs) that list all the applicants who
are both eligible and qualified. Each cert is tied to a specific hiring path condition designated as
acceptable in the vacancy announcement. These certs are provided to the hiring manager for the
next stage of the selection process, along with the resume of each candidate appearing on at least
one of the certs, and any other supporting documentation relevant to the applicant’s qualifications
to perform in the position. 22 With the exception of some hiring paths specific to veterans, 23 hiring
managers may select any name from any cert based solely on the information provided in the
Periodic notifications regarding the status of the application are also sent to the applicant throughout the course of
the hiring process unless the applicant elects in his or her USAJOBS profile not to receive them.
21
Examples of reasons why an applicant might not be referred include failure to provide required documentation,
failure of resume to adequately reflect ability to perform job duties, or failure to meet hiring path requirements based
on supporting documentation submitted.
22
HR specialists typically limit supporting documentation to cover letters and performance evaluations, assuming
any were provided by the applicant, in the interest of protecting applicant privacy.
23
Hiring managers are required to select disabled veterans over other candidates who appear on certs in various
circumstances. Information about selection rules regarding veteran hiring preferences can be found at
https://www.fedshirevets.gov/job-seekers/special-hiring-authorities/.
20

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 8

resume and other supporting documentation. More commonly, however, hiring managers choose
to also conduct interviews with top candidates and to check professional references.
Certs at DHS are valid for up to 240 days, meaning that hiring managers can request HR
specialists to reissue a cert if a candidate drops out of the hiring process anytime within the 240day window. If more than 240 days have elapsed since the HR specialist issues a cert at the point
a candidate drops out or becomes ineligible for employment, the hiring manager must reissue the
job announcement and start the hiring process over again.
Interviews may be conducted by phone, in person, or by other means. To coordinate an
interview, hiring managers or their support staff typically reach out to applicants they would like
to interview directly by using the contact information contained on the applicants’ resumes. The
hiring manager may conduct the interviews one-on-one or choose to organize an interview panel.
Interviewers develop questions in advance or extemporaneously during the course of the interview,
but all questions must pertain to the applicant’s ability to successfully perform in the position.24
Interviewers are strongly encouraged to take interview notes in case the selection is challenged,
and any notes taken by interviewers become federal records.
Reference checks are also usually conducted by hiring managers; outreach to references
may occur by phone, email, or by any other means specified by the applicant. If the applicant did
not already provide reference contact information in the resume, the hiring manager may reach out
to the applicant directly for this information using the applicant’s contact information listed on the
resume. Questions asked of references must directly pertain to the reference’s knowledge
regarding the applicant’s ability to perform the duties of the position. Reference contact
information may not be used for any reason other than conducting the reference checks and should
be destroyed once the reference checks are complete.
The hiring manager may ultimately select as many candidates from the certs as were
specified in the job announcement based on his or her review of application materials and the
results of any interviews and reference checks. Once all selections are made, the hiring manager
provides the names of the selectees to HR specialists via USA Staffing or CASS. HR specialists
then send temporary job offer letters (TJO) to each selectee informing them they have been
tentatively selected for the position and the conditions under which the tentative offer is being
made. The TJO also explains that a final offer is subject to a criminal background check, a drug
screening (if applicable), and other suitability determinations relevant to the position. 25 Selectees
who indicate their acceptance of the TJO begin the onboarding process. If a selectee declines the
Likewise, hiring managers may not ask about personal information unless the answer would likely bear directly
on job performance.
25
Other suitability determinations may include ability to obtain a required clearance level, validation that the
candidate holds a required professional license or certification.
24

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 9

temporary offer, the HR specialist informs the hiring manager and the hiring manager may ask the
HR specialist to reissue certs from the same job announcement so long as 240 days have not
elapsed. 26
TJO Case Records Creation
Candidates who accept TJOs are required to complete and upload certain pre-security
forms, a current copy of their resume, and proof of any certifications that may be required for the
position into the online portal of USA Staffing or CASS. The pre-security forms, all of which
contain Privacy Act Statements, consist of:
•

•

•

Optional Form (OF)-306, Declaration for Federal Employment – used to determine
acceptability for federal and federal contract employment, and enrollment status in the
Government’s Life Insurance Program;
DHS-110005, Pre-Screen for Clearance Form – used to verify data that will be used to
conduct a background investigation on the candidate suitable to the clearance level
required for the position; and
DHS-110009, DHS Credit Release Form – signed release permitting DHS to obtain credit
reports from consumer/credit reporting agencies.

Once uploaded, data elements from the forms are automatically extracted and sent to DHS’s
Enterprise Information Environment (EIE), 27 including the candidate’s Social Security number
(SSN) as listed on the OF-306. EIE then automatically sends a request via a secure connection to
DHS’s Integrated Security Management System (ISMS) 28 to ensure a case record exists in the
system that includes a person handle. 29 If the candidate is a former DHS employee, a case record
If 240 days have elapsed since the original selection was made, the hiring manager must repost the job
announcement and start the hiring process over again.
27
EIE is a collection of hardware, software, and online data storage that supports the business and information needs
of OCHCO. The system serves as a consolidated authoritative source for human capital information across the
Department, and it functions as a data broker among all enterprise-level HR systems at DHS. To support its
information-sharing role, EIE houses a secure data repository containing personnel data on every employee at DHS.
For an in-depth discussion of EIE, including the type of data it retains and the other systems to which it
interconnects, see U.S. DEPARTMENT OF HOMELAND SECURITY, PRIVACY IMPACT ASSESSMENT FOR WORKFORCE
ANALYTICS AND EMPLOYEE RECORDS, DHS/ALL/PIA-075 (2019), available at https://www.dhs.gov/privacydocuments-department-wide-programs.
28
ISMS is a DHS-wide web-based case management application designed to support the lifecycle of the DHS
personnel security, administrative security, and classified visit management programs. See U.S. DEPARTMENT OF
HOMELAND SECURITY, PRIVACY IMPACT ASSESSMENT FOR THE INTEGRATED SECURITY MANAGEMENT SYSTEM
(ISMS), DHS/ALL/PIA-038 (2011 and subsequent updates), available at https://www.dhs.gov/privacy-documentsdepartment-wide-programs.
29
Person handle is a unique personal identifier that is assigned to every DHS employee and contractor at the time he
or she accepts a TJO or is onboarded. It was developed for use in lieu of SSN to reduce privacy risks to DHS
personnel and is used in various system throughout the Department. EIE sends ISMS the SSN of the candidate as
listed on the OF-306 via a secure connection. ISMS then associates a person handle to the SSN and returns this
26

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 10

will already exist, and ISMS will locate the record, update it with information collected in the presecurity forms and uploaded resume, and rely on it for the remainder of the Talent Acquisition
process. If the candidate has never been employed at DHS, ISMS will create a new case record
that includes a new person handle. Either way, the candidate’s new or updated case record is
returned to EIE and the online portal of USA Staffing or CASS is updated to show that the case
records were created and that the pre-security forms and resume have been stored in ISMS.
Pre-Employment Suitability Checks
Once the candidate uploads the pre-security forms, updated resume, and any required proof
of certifications into the USA Staffing or CASS onboarding portal, and after the candidate’s case
record is created or updated via a system request from EIE to ISMS, the process for conducting
the candidate’s pre-employment suitability checks can begin. These suitability checks consist of
an initial reciprocity determination within OPM’s Central Verification System (CVS) 30 for those
candidates that are former federal employees, a drug test for most positions, 31 a fingerprint
collection for those candidates without reciprocity, and a credit check for all candidates regardless
of job history or prospective position. The candidate is required to schedule the drug test and
fingerprint appointment directly from the USA Staffing or CASS onboarding portal via links to
the providers’ scheduling systems. The credit checks are conducted by the appropriate personnel
security office at DHS (PerSec) 32 using information collected on the DHS-110005 form, and per
the consent granted by the signed release on the DHS-110009 form, with no need for additional
action required from the candidate. 33

information to EIE via the same secure connection. This eliminates the need of SSN being used unnecessarily
throughout the Department.
30
CVS is designated as the primary tool for facilitating reciprocal decisions, as required by Executive Orders,
regulations, and policies. CVS contains information on security clearance, suitability, fitness, and Homeland
Security Presidential Directive 12 (HSPD-12) Personal Identity Verification (PIV) credentialing determinations for
current and former federal employees. The information is provided by agency sources, legacy personnel security
systems, and a bridge to the Department of Homeland Security Joint Personnel Adjudication System. For more
information about CVS, and about OPM’s role in federal background investigations generally, See U.S. OFFICE OF
PERSONNEL MANAGEMENT, PRIVACY IMPACT ASSESSMENT FOR THE PERSONNEL INVESTIGATIONS PROCESSING
SYSTEM (PIPS) (2017), available at https://www.opm.gov/information-management/privacy-policy/privacypolicy/pips-pia.pdf.
31
Some DHS Components do not require drug tests for employees who are moving to new positions within the
Component and who had a previous drug test while working in the Component.
32
Each Operational Component at DHS has its own personnel security office that screens job candidates for
positions within their respective Component.
33
For detailed information on the processes and information collections and uses required to execute the presuitability checks, see supra note 28. For a more extensive discussion of the drug test pre-suitability check
specifically, see U.S. DEPARTMENT OF HOMELAND SECURITY, PRIVACY IMPACT ASSESSMENT FOR THE DRUG FREE
WORKPLACE PROGRAM, DHS/ALL/PIA-063 (2018), available at https://www.dhs.gov/privacy-documentsdepartment-wide-programs.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 11

If the results of this preliminary screening are adjudicated in favor of the candidate for all
three checks, the process moves into the background investigation phase. If any of the suitability
checks are negatively adjudicated, the HR specialist informs the candidate that the TJO is being
rescinded and stops all onboarding processes. The hiring manager may then offer a TJO to another
candidate on a reissued cert (provided 240 days have not elapsed), restart the hiring process
altogether by reposting the position on USAJOBS, or terminate the search for a new candidate
entirely.
Background Investigation
Some candidates will be required to undergo a background investigation. The background
investigation phase, if needed, will always occur immediately after the pre-employment suitability
check phase for law enforcement positions and positions that require a Top Secret/Sensitive
Compartmented Information (TS/SCI) clearance. For positions that are not law enforcement or
that require a lower level clearance than TS/SCI, the hiring manager has the option to offer a
provisional job offer to the candidate while the investigation is still underway, with the
understanding that the candidate’s employment will be terminated if the results of the investigation
are ultimately adjudicated negatively.
Background investigations are initiated and adjudicated by PerSec and are conducted by
OPM. Once the background investigation adjudication is made, PerSec stores the determination
in ISMS along with all the information upon which the decision was based. A select few HR
specialists in each human capital office can then retrieve the pass/fail determination in a daily
production report generated by ISMS. These HR specialists will notify the HR specialists
managing the relevant positions, and they in turn inform the hiring manager of the determination
and update the USA Staffing or CASS onboarding portal to reflect the determination. 35
34

If the candidate does not pass the background investigation and is still in the hiring process,
the HR specialist informs the candidate that the TJO is being rescinded and stops all onboarding
processes. If the candidate has already been provisionally hired subject to the results of the
investigation, the employment will be terminated, and the candidate will be separated from all
DHS systems and facilities. Either way, as with the three pre-employment suitability checks, the
hiring manager has the option to offer a TJO to another candidate listed on the certs previously
provided by the HR specialist (if 240 days have not yet passed since the certs were issued).

34
For detailed information about processes and privacy issues related to background investigations at DHS, see
supra note 28.
35
The only information PerSec provides to the HR specialists is whether the candidate passed or failed the
investigation, and this is the only information entered into USA Staffing and CASS. USA Staffing and CASS also
update the candidate’s record in EIE with this information via an automated data feed.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 12

If the candidate passes the background investigation, the HR specialist provides
notification of eligibility for full performance in the position. Assuming the candidate is still in the
hiring process, the HR specialist will work with the candidate (and with the losing agency in the
event the candidate is already a federal employee and is moving into a position of the same pay
grade) to select an “Entry on Duty” (EOD) date. Once the EOD date is determined, the HR
specialist will update the USA Staffing or CASS onboarding portal to reflect the date and will send
a final job offer (FJO) to the candidate specifying the terms of employment and providing
instructions on how to begin the onboarding process. If the candidate was already provisionally
hired subject to the results of the background investigation, the HR specialist simply notifies the
employee and the hiring manager of the successful adjudication and the employee becomes eligible
to access any DHS systems or locations that were awaiting the results of the investigation.
FJO Case Records Creation
Candidates who accept final job offers begin the onboarding process by accessing a link in
USA Staffing or CASS that provides all the forms needed to complete the process. Forms relevant
to all DHS new hires include:
•

•
•

•

•

•
•
•

SF-61, Appointment Affidavits – collects signed affidavit affirming oath of office,
commitment not to strike against the federal government, and assurance that no payment
or other consideration was received in return for appointment;
I-9, Employment Eligibility Verification – verifies the identify and employment
authorization of individuals hired for employment anywhere in the United States;
SF-144, Statement of Prior Federal Service – ensures all prior federal service is
documented to ensure proper credit for leave benefits, retirement, and retention status in
case of a reduction-in-force (RIF);
SF-181, Ethnicity and Race Identification – captures ethnicity and race data to assist in
managing DHS’s Equal Employment Opportunity (EEO) and affirmative employment
responsibilities (voluntary);
SF-256, Identification of Disability – captures types of disabilities to support Executive
Branch programs designed to facilitate the hiring, placement, and advancement of
individuals with disabilities (voluntary);
SF-1199A, Direct Deposit Sign Up Form – collects information about the financial
institution the appointee would like his or her salary deposited;
State Withholding Exemption Form – specifies the number of state tax exemptions claimed
by the appointee (form varies by state of residence);
Form W-4 – specifies the number of Federal employee tax exemptions claimed by the
appointee;

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 13

•

•
•

AD-349, U.S. Department of Agriculture (USDA) Employee Address – collects
appointee’s current or new residence mailing address for purposes of mailing out employee
Pay and Thrift Savings Plan (TSP) statements;
DHS Veterans Service Status – collects veterans’ status, if any, pertaining to era and type
of service for application to benefits and retirement; and
DHS Non-Disclosure Agreement – collects new hire’s signed affirmation not to disclose
Protected Critical Infrastructure Information (PCII), Sensitive Security Information (SSI),
and other Sensitive But Unclassified (SBU) information.

The candidates are asked to complete the forms and submit them back to the HR specialist who
handled the hiring action via USA Staffing or CASS. 36 Once the HR specialist receives the forms,
he or she routes them to the appropriate administrative personnel for processing. DHS Components
that use CASS can rely on the system to route them to the appropriate personnel. Since USA
Staffing does not have the capability to easily route documents, Components who use that
onboarding system typically rely on a workflow management and case tracking system called
FedHR Navigator.
FedHR Navigator
FedHR Navigator is a vendor-managed system used by many federal agencies that
automates HR functions and supports the strategic management of human capital. The tools
contained within FedHR Navigator support simultaneous database access by employees and HR
personnel. The main tool within the application is the Federal Retirement Benefits (FRB) Web,
which is a calculator that generates benefits information. Another feature is the Forms Manager,
which allows employees and HR personnel access to over 150 electronic federal forms for use in
onboarding; employee separation and transfer; processing deposit and redeposit payments; and
completing federal thrift savings plan (TSP), Federal Employment Health Benefits (FEHB), and
Federal Employee’s Group Life Insurance (FEGLI) elections. The system also assists with
retirement planning, HR case tracking, personnel data management, and reporting.
In the context of onboarding, HR specialists primarily use FedHR Navigator to route HR
forms and documents to the appropriate personnel for processing, track where candidates are in
the onboarding process, and communicate general information to other HR specialists regarding
onboarding status. The system also can be programmed to generate metrics that assist management
with understanding who is responsible for which onboarding actions, trends in hiring levels, and
other information designed to facilitate managerial decision making.

If the new hire fails to complete some or all the forms, they will be asked to do so in person at new employee
orientation.

36

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 14

New Hire Provisioning
As the first set of onboarding forms are being processed, efforts begin to provide the new
hire with access to facilities, systems, applications, and equipment needed to effectively perform
in the job. This process begins with an automatic data feed from USA Staffing or CASS to EIE
updating the new hire’s record to reflect the projected EOD date. EIE then feeds the following
information into the DHS Office of the Chief Information Officer’s (OCIO) Trusted Identity
Exchange (TIE): 37
•
•
•
•
•
•
•
•
•
•
•

Person Handle;
Name (First, Middle, Last);
Office Location (City, State, Country);
Organization Code;
Position Title;
EOD Date;
Employee Type (Employee/Contractor);
Contract Number (if applicable);
Clearance Level (to help identify which systems the new hire will need to access);
Supervisor Name (First, Middle, Last); and
Supervisor Person Handle.

TIE in turn feeds this data into the DHS Access Lifecycle Management System (ALM) 38 for
relevant network access and any required software. ALM also sends automated notification
requests to Component IT offices for a mobile phone, IP address, desk phone, email address, and
mailbox. Simultaneously, the hiring manager takes the steps needed to identify the new hire’s
workspace and provision it with necessary equipment.
Entry on Duty
New hires attend a new employee orientation during their first two days as a DHS
employee. The orientation begins with the new hires taking their federal oath of office. New hires
TIE is a secure DHS exchange service that serves as an intermediary between authoritative data sources (i.e.
applications or systems that maintain information about DHS employees and contractors) and consuming
applications (i.e., applications or systems that request information from the TIE about specific DHS employees or
contractors. See U.S. DEPARTMENT OF HOMELAND SECURITY, PRIVACY IMPACT ASSESSMENT FOR THE DHS
TRUSTED IDENTITY EXCHANGE, DHS/ALL/PIA-050 (2017), available at https://www.dhs.gov/privacy-documentsdepartment-wide-programs.
38
ALM is a DHS system and program that receives core identity information about new employees from TIE and
uses digital policies to automatically provide the new employee’s account access and authorization information to
the network, email, facility control, training, and time and attendance systems. See U.S. DEPARTMENT OF
HOMELAND SECURITY, PRIVACY IMPACT ASSESSMENT FOR THE ACCESS LIFECYCLE MANAGEMENT, DHS/ALL/PIA058 (2017), available at https://www.dhs.gov/privacy-documents-department-wide-programs.
37

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 15

spend the remainder of the orientation being briefed on general matters of importance to DHS
employees such as the Department’s history, mission and goals; payroll, retirement, and benefits
processes; physical and IT security; privacy and records management; ethics and integrity
awareness; and employee appeal rights. Attendees are also required to complete several
onboarding benefits forms that require in-person rather than digital signatures. These include:
•
•
•
•
•
•
•
•

Appointment Affidavit committing to uphold the oath of office;
SF-1152, Designation of Beneficiary for Unpaid Compensation of Deceased Employee;
SF-2809, Health Benefits Election;
SF-2817, Life Insurance Election;
SF-2823, Designation of Life Insurance Beneficiary;
SF-3102, Designation of Federal Pension Beneficiary;
TSP-1, Thrift Savings Plan Election Form; and
TSP-3, Designation of Thrift Savings Plan Beneficiary.

Processing and Storing Onboarding Documents
The benefits forms that were signed at new employee orientation, as well as the tax-related
forms submitted via USA Staffing or CASS upon receipt of the FJO, are routed to the appropriate
HR specialists for processing. To process the forms, a profile for each new hire is first created in
EmpowHR, which is a National Finance Center (NFC) 39 shared service that supports payroll and
personnel processing. Once the profile is complete, any onboarding documents that OPM
considers official personnel records are uploaded into the candidate’s Electronic Official Personnel
Folder (eOPF) file. 40
EmpowHR
HR specialists working in the payroll and benefits fields enter information from the
onboarding forms such as job code, pay grade, geographic location, tax withholdings, benefits
elections, awards, and other finance-related information into EmpowHR so the system can
calculate employee salary or wage. EmpowHR then feeds this information into NFC databases for
payroll processing. This data feed, when combined with information fed into the database from

NFC is a federal agency under the USDA Office of the Chief Financial officer. It provides HR, financial, and
administrative services for agencies across the federal government. For more information about NFC and its
services, see https://www.nfc.usda.gov/.
40
eOPF is a shared service managed by OPM. OPM serves as the chief HR agency and personnel policy manager
for the federal government. See U.S. OFFICE OF PERSONNEL MANAGEMENT, PRIVACY IMPACT ASSESSMENT FOR THE
EOPF SYSTEM (2017), available at https://www.opm.gov/information-management/privacy-policy/privacypolicy/eopf-pia.pdf.
39

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 16

another NFC shared service, Web Time and Attendance (WebTA), 41 is used by NFC to calculate
employee paychecks.
eOPF
eOPF provides a digitized recreation of federal civilian employees’ official personnel
records. eOPF files are created when an employee begins federal service and are maintained
throughout the employee’s career in accordance with OPM regulations. Employees can access
their personnel records in eOPF at any time by signing into the system with a username and
password. Documents that are scanned into eOPF as part of the onboarding process include all the
beneficiary forms signed during new employee orientation, as well as the I-9, OF-306, and SF-144
that were digitally signed and sent to the HR specialist via USA Staffing or CASS upon acceptance
of the FJO. An SF-50 appointment letter is also scanned into the system and uploaded into USA
Staffing or CASS to close the talent acquisition case.
Commencement of Job Duties
After the two-day new employee orientation ends, new hires begin performing their job
duties in the new space provisioned for them by the hiring manager. From this point on, any HRrelated issues or concerns, including those onboarding functions such as setting up payroll or
establishing benefits, can be addressed using the FHR Navigator system or by contacting their
Component or Office’s local HR representatives. Employees will also have access to their official
HR records in eOPF throughout the length of their employment.

Section 1.0 Authorities and Other Requirements
1.1

What specific legal authorities and/or agreements permit and
define the collection of information by the project in question?

Under 5 U.S.C. § 1104, OPM has delegated to agencies the authority to conduct
competitive examinations for positions in the competitive service, except for administrative law
judge positions. DHS hiring authorities receive their delegation authority from OPM and have two
fundamental responsibilities: to ensure that the agency’s vacant positions are filled with the bestqualified persons from a sufficient pool of well-qualified eligible candidates and to uphold the
laws, regulations, and policies of merit selection as defined in 5 U.S.C. §§ 2301 and 2302.

41
WebTA is used by federal employees to document hours worked and leave taken. This information is fed into an
NFC database once per pay period for calculation of the employee’s periodic pay. See U.S. DEPARTMENT OF
HOMELAND SECURITY, PRIVACY IMPACT ASSESSMENT FOR THE DHS WEB TIME AND ATTENDANCE (WEBTA)
SYSTEM, DHS/ALL/PIA-009 (2008), available at https://www.dhs.gov/privacy-documents-department-wideprograms.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 17

1.2

What Privacy Act System of Records Notice(s) (SORN(s)) apply
to the information?

Information collected, maintained, used, and disseminated by DHS when conducting its
Talent Acquisition business function is covered by several government-wide SORNs developed
and managed by OPM and Department-wide SORNs managed by DHS:

1.3

•

OPM/GOVT-1 General Personnel Records, 77 Fed. Reg. 73694 (December 11,
2012), as modified by 80 Fed. Reg. 74815 (November 30, 2015);

•

OPM/GOVT-5 Recruitment, Examining, Placement Records, 71 Fed. Reg. 35351
(June 19, 2006), as modified by 80 Fed. Reg. 74815 (November 30, 2015);

•

OPM/GOVT-6 Personnel Research and Test Validation Records, 71 Fed. Reg.
35354 (June 19, 2006), as modified by 80 Fed. Reg. 74815 (November 30, 2015);

•

OPM/GOVT-7 Applicant Race, Sex, National Origin and Disability Status
Records, 71 Fed. Reg. 35356 (June 19, 2006), as modified by 80 Fed. Reg. 74815
(November 30, 2015);

•

DHS/ALL-002 DHS Mailing and Other Lists System, 73 Fed. Reg. 71659
(November 25, 2008);

•

DHS/ALL-022 Department of Homeland Security Drug Free Workplace, 73 Fed.
Reg. 64974 (October 31, 2008); and

•

DHS/ALL-023 Personnel Security Management, 75 Fed. Reg. 8088 (February 23,
2010).

Has a system security plan been completed for the information
system(s) supporting the project?

Yes. SMORE resides on DHS’s Customer Relationship as a Service (CRMaaS) platform
and is covered by the CRMaaS system security plan. The system was last accredited August 23,
2017 and is continuously monitored as part of DHS’s Ongoing Authorization program. A system
security plan was completed for CASS on January 31, 2019. DHS is currently working to accredit
the system based on the security findings identified in the plan. EIE is a minor application of the
OCHCO Virtual Production Enclave (VPE) and is covered by the OCHCO VPE system security
plan. The system was last accredited April 20, 2017 and is continuously monitored as part of
DHS’s Ongoing Authorization program. FedHR Navigator has its own system security plan and
was last accredited October 12, 2016. It is continuously monitored as part of DHS’s Ongoing
Authorization program.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 18

All Component systems listed int the Appendix also fall under these same accreditation
requirements.
USAJOBS, USA Staffing, and USA Hire are all external information systems managed by
OPM and thus OPM is responsible for their system security plans. EmpowHR and WebTA are
both external information systems managed by NFC and thus NFC is responsible for their system
security plans.

1.4

Does a records retention schedule approved by the National
Archives and Records Administration (NARA) exist?

Yes. The NARA General Records Schedule (GRS) 2.1, Employee Acquisition Records
covers all categories of information that directly support Talent Acquisition at DHS. 42 GRS 2.2,
Employee Management Records, items 040, 041, 050, and 060 also cover certain records created
during the hiring process that are retained throughout an individual’s period of employment. 43

1.5

If the information is covered by the Paperwork Reduction Act
(PRA), provide the OMB Control number and the agency number
for the collection. If there are multiple forms, include a list in an
appendix.

At the applicant’s discretion, the following standard federal forms may be submitted by the
applicant into USAJOBS during the initial application process:
• Verification of Indian Preference for Employment, BIA-4432
• Discharge Papers and Separation of Documents, DD-214
• Declaration for Federal Employment, OF-306
• Application for 10-point Veteran Preference, SF-15
• Notification of Personnel Action, SF-50
The following standard federal forms are collected from candidates who receive TJOs:
•
•
•

Declaration for Federal Employment, OF-306
Pre-screen for Clearance Form, DHS-110005
DHS Credit Release Form, DHS-110009

The following standard federal forms are collected from candidates who receive FJOs:
•

Appointment Affidavits, SF-61

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION, GENERAL RECORDS SCHEDULE 2.1: EMPLOYEE
ACQUISITION RECORDS, available at https://www.archives.gov/records-mgmt/grs.html.
43
NATIONAL ARCHIVES AND RECORDS ADMINISTRATION, GENERAL RECORDS SCHEDULE 2.2: EMPLOYEE
MANAGEMENT RECORDS, available at https://www.archives.gov/records-mgmt/grs.html.
42

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 19

•
•
•
•
•
•
•

Employment Eligibility Verification, I-9
Statement of Prior Federal Service, SF-144
Ethnicity and Race Identification, SF-181 (voluntary)
Identification of Disability, SF-256 (voluntary)
Direct Deposit Sign Up Form, SF-1199A
Employee Withholding Certificate, Form W-4
USDA Employee Address, AD-349

The following forms are collected from new employees at the new employee training event:
•
•
•
•
•
•
•

Designation of Beneficiary for Unpaid Compensation of Deceased Employee, SF-1152
Health Benefits Election, SF-2809
Life Insurance Election, SF-2817
Designation of Life Insurance Beneficiary, SF-2823
Designation of Federal Pension Beneficiary, SF-3102
Thrift Savings Plan Election Form, TSP-1
Designation of Thrift Savings Plan Beneficiary, TSP-3

Section 2.0 Characterization of the Information
2.1

Identify the information the project collects, uses, disseminates, or
maintains.

SMORE currently collects the following PII on recruiters and vendor POCs who assist at
DHS-sponsored recruitment events:
•
•
•
•
•
•
•
•

Name
Salary (masked in the system to analysts)
Grade, step, and year these were obtained (masked)
Hourly rate, if applicable (masked)
Total salary cost (masked)
Role
Number of hours spent at event
Vendor POC (name, business phone, business email)

SMORE also collects PII from individuals who register for recruitment webinars. This PII is
collected via an electronic registration survey and most of it is automatically aggregated to produce
real-time analytics dashboards. PII is not linkable back to the registrant since SRDI intentionally
avoids linking individuals to survey answers.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 20

•
•
•
•

•
•

•
•

•
•
•
•
•

U.S. Citizenship (Y/N)
Employee Type (DHS Employee/Contractor/Non-DHS Employee/Student)
Student Status (Y/N)
If Student:
o Name of Academic Institution (not aggregable)
o Type of Student (Community College/Undergraduate/Graduate/Recent
Graduate)
o Class (Freshman/Sophomore/Junior/Senior)
o Major (not aggregable)
o Interest (Internship, Post-Graduate)
o Expected Graduation Date
Veteran Status (Y/N)
If Veteran:
o Military Branch (Army, Air Force, Coast Guard, Marine Corps, Navy, National
Guard, Reserves)
o Military Status (Active Duty, Retired, Served but Did Not Retire)
o Veterans Preference (5-point;10-point with 10-30% disability; 10-point with
30+% disability; 10-point for non-compensable disability; 10-point based on
wife, widow, or widower; not sure or unknown)
o Schedule A Disability (Y/N)
o Professor/Faculty (Y/N)
Prior Federal Employment (Y/N)
Special Hiring Authorities (Schedule A, Veterans Recruitment Appointment, 30% or
More Disabled Veteran, Disabled Veteran who has completed a VA Training Program,
Derived Preference, Not Applicable)
Career Interest
How Registrant Learned About Webinar
How Knowledgeable Registrant is About DHS Careers
How Likely Registrant is to Apply for a Job at DHS
Whether Registrant has Profile in USAJOBS (Y/N)

The SMORE webinar recruitment survey also collects the following optional information:
•
•
•
•

Whether registrant opts to respond to demographic portion of survey (Y/N)
Gender (M/F)
Ethnicity (Hispanic or Latino/Non-Hispanic or Non-Latino)
Race (American Indian or Alaska Native, Black or African American, Native Hawaiian
or other Pacific Islander, White)

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 21

The following information is collected from applicants when they create profiles in USAJOBS:
•
•
•
•
•
•
•
•

•

Name
Address
Email
Phone
Citizenship Status (Y/N)
Selective Service Registration Status (Y/N/NA)
Highest Education Obtained
Eligible Hiring Paths (U.S. Citizens, Federal Employees, Peace Corps & AmeriCorps,
Veterans, Military Spouses, National Guard & Reserves, Students, Recent Graduates,
Senior Executives, Individuals with Disabilities, Family of Overseas Employees,
Native Americans, Land and Base Management)
Federal Employment Status (current, former with reinstatement eligibility, former
without reinstatement eligibility, not a federal employee)

Other PII related to current employment status; knowledge, skills, and abilities; and hiring path
status may be entered at the discretion of the user creating the USAJOBS profile depending on
answers to the above questions.
The following PII is collected via the various forms that applicants and others involved in
the Talent Acquisition process are either required to submit, or that the applicant chooses to
submit at his or her discretion:
Candidate/Employee Information
•
•
•
•
•
•
•
•
•
•
•
•

Name
Address
Phone (Duty/Work, Night/Home, Cell)
Email (Personal, Office)
SSN
Place of Birth
Date of Birth (DOB)
Citizenship (U.S., Dual, Noncitizen U.S. National, Lawful Permanent Resident, Alien
Authorized to Work, Country, Permanent Resident Number)
Marital Status
Gender
Disability Code
Hispanic or Latino (Y/N)

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 22

•
•
•
•
•
•
•
•
•
•

Race (American Indian or Alaskan Native, Asian, Black or African American, Native
Hawaiian or Other Pacific Islander, White)
Spouse Name
Spouse SSN
Father’s Name
Mother’s Name/Maiden Name
Employee ID (if applicable)
Current Federal Organization Assigned (if applicable)
Identity Document (Title, Issuing Authority, Document Number, Expiration Date)
Selective Service Registration (Y/N, if no provide reason)
Signatures (Applicant or Appointee Signature, Date)

Financial Disclosure Information
•
•

Personal Assets, U.S. and Foreign (e.g., Annual Income, Bank Accounts, Investment
Accounts, Real Estate, Leased Vehicles, Other Assets, Safe Deposit Box)
Personal Liabilities, U.S. and Foreign (e.g., Mortgages, Liens, and Other Liabilities;
Credit Cards, Bankruptcy)

Education Information
•
•

Education Type (Level, Year Obtained, Major, School Information)
License/Certification/Registration Information (State, Type, Number, Date Issued, Date
Expires, Any Revocations)

Military/Career Information
•

•
•
•
•
•

Veteran Information (Veteran Status, Veteran’s Preference Information, Veteran Name,
Rank, Active Duty Entry Date, Retire or Fleet Transfer Date, Type of Discharge,
Veterans Deceased Status, Creditable Military Service, Service Administrative Files,
Service Medical Records)
Previous Employment (Position Title, Grade, Name of Employer, Type of Service,
Agency Code, Duty Station, Business Address, Agency Data, Length of Employment)
Personnel File Information (Location, Date Sent)
History of Employment Absence Without Pay (Lost Time, Total Number of Days)
Type of Appointment (Full-Time, Part-Time, Intermittent)
Pay Information (Pay Plan, Occupational Code, Grade or Level, Step or Grade, Date
Entered Current Grade, Date of Last Within Grade Increase, Date of Grade Increase
Denial, Date of Last Quality Step Increase, Total Salary, Pay Basis, Basic Pay, Earning,
Locality Adjustment, Adjusted Basic Pay, Other Pay, Retention Allowance,

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 23

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Supervisory Differential, Availability Pay, Special Pay Authority, Pay Retention
Information, Highest Salary Information)
Service Obligation (Due to Training Received, Due to Recruitment or Relocation
Bonus, Expiration Date)
Employee Payroll Data (Payroll Office Information, Year to Date Pay Information,
Begin Date, Not to Exceed Date)
W-4 Information (Marital Status, Total Number of Allowances, Additional Amount,
Total Amount
Personnel Actions (Action Code, Nature of Action, Authority Code, Legal Authority,
Receipt Date, Effective Date)
Agency Official Signature and Title
Tenure, Reduction in Force, and FEGLI Information
Service Computation Date
Work Schedule
Part-Time Hours
Fair Labor Standards Act (FLSA) Category (Exempt/Non-Exempt)
Appropriation Code
Bargaining Unit Status
Civilian Retirement Date
Retirement System Paying Annuity
Frozen Service (Years, Months)
Federal Employees' Retirement System (FERS) Coverage (Elected FERS, Covered
Automatically, Never Covered)
Personnel Office Code
Ratings of Records (Level, Pattern, Period)

Position and Employment Information
•
•
•
•
•
•
•
•

Employer Information (Agency or Organization Name, Organization Code, Employer
Identification Number, Address)
Job Information (Position Title, Position Number)
Employee Status (Civilian, Retired, Compensationer, Employee, Former Employee)
Provisional Clearance Status (Elected, Not Elected)
Position Type (Federal, Contractor, Detailee, Other)
Medical Provider Type
Detail Type (Federal, State, Local Detailee, Other)
Residency Requirement (Yes/No, Institution Name/Address/Phone)

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 24

•
•
•
•
•
•
•
•
•

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Foreign Residency/Employment/Education in Last Three years (Country, Explanation,
Begin Date, End Date)
Detail Information (POC Name, Sponsor Name, Duty Location)
Position Category (Permanent, Downgrade/Upgrade, Temporary, Cancel)
Pay Plan and Organizational Code
Grade or Level
Series
Agency Personnel Office that Services the Position
EOD Date/First Day
Losing Agency Release Data (Acceptable EOD Date, Earliest Possible Release Date,
Release Date POC, Individual Releasing Data, Releasing Agency Contact Information,
Signature and Date)
Date of Rehire
Temporary Position Period of Performance
Office of Internal Affairs Applicant (Y/N)
Internal Affairs Personnel Security Division Applicant (Y/N)
Security Clearance Required (Y/N)
Position Description (Critical Sensitive/Non-critical Sensitive/Non-Sensitive/High-Risk
Public Trust/Moderate Risk Public Trust)
Position Sensitivity (Critical Sensitive/High-Risk)
Clearance Level (TS/SCI/TS/Secret/None)
Pre-Appointment Waiver Request (Y/N, Date of Request)
Training (Training Plan Required, Description, Completion Date)
Contractor Position History (Y/N, Previous Employment End Date)
Employment Category (Federal New Hire, Detailee, Consultant, Former Federal
Employee, Date Left Federal Service, Agency Transferred From)
Position Location/Address
Supervisor/Point of Contact (Name, Office/Component, Office Phone Number, Office
Email)
Appointment Data (Nature of Action, Appointment Type, Authority for Appointment,
Date)
Date of Most Recent Career Conditional Appointment
Probation Data (Position Type, Begin Date, End Date)
Unfavorable Data (Y/N in Official File, Y/N in Other Files, POC Name, POC Phone)
Code of Conduct – Acknowledged Having Read (Y/N)
FEHB Data (Waived, Cancelled, Ineligible, Enrolled, Date of Enrollment)

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 25

Investigation/Clearance Information
•
•
•
•
•
•
•
•
•
•
•
•
•

•
•
•
•
•

Current Agency
Investigative Service Provider
Status of Background Investigation (Completed/Pending, Date Completed/Initiated)
Investigation Type
Purpose of Investigation (New Hire, Rebadge, Reinvestigation, Other)
Clearance Type (Interim/Final)
Clearance Level
Date Clearance Granted (Date Full Clearance Granted, Temporary Clearance Start
Date, Temporary Clearance End Date, Reissued Date, Date Clearance Ended)
ID Badge Information (Badge Type, Badge Number, Issue Date, Expiration Date,
Status)
All Family Members U.S. Citizens (Y/N)
Applicant Held SCI Access Before (Y/N)
Department/Agency Clearance was Held
Access Questions (Why Does Individual Needs Access? Requirement That Can Be
Filled by Office of Intelligence Personnel? How/Where will SCI Information Be
Accessed? Who is Provider of Information? What is Present Level of Clearance and
Who Granted It?)
Other Remarks
Special Security Officer (Full Name, Signature, Date, Phone)
Personnel Security Clearance Determination (Initiation Required, Reciprocity Eligible,
Reactivate, Reciprocity Revoked)
Has Individual held SCI Access Within Last Two Years (Y/N)
Was SCI Access Granted with a Waiver (Y/N)

Benefits Information
•
•
•
•
•
•

FEHB Waiver Information (Waive Participation in Premium Conversion, Pre-Tax
Deduction Reason)
Dependent Information (Full Name, SSN, DOB, Gender, Relationship Code, Address,
Email, Phone)
Health Insurance Enrollment (Medicare Information, Current Plan, New Plan, Event
Code, Date of Life Event, Enrollment Status)
4-Digit Insurance Code
SF-50 Equivalent 2-Digit Code
FEHB Option (Option A – Standard, Option B – Additional, Option C – Family)

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 26

•

•

•

Direct Deposit Information (Full Name of Person Entitled to Payment, Account
Information, Payment Type, Payment Allotment, Payee Signature and Date, Joint
Account Holder Signature and Date, Name of Individual Submitting Form, Agency
Name, Agency Address, Financial Institution Information)
Thrift Savings Plan Information (Account Number, Account Type, Service
Computation Date, Vesting Code, Status Code, Status Date, TSP Loan Information,
TSP Allocation, Percentage of Basic Pay, Whole Dollar Amount, G Fund Percentage, F
Fund Percentage, C Fund Percentage, TSP Certifier Name/Signature/Date, TSP
Election Information)
Designation of Beneficiary Information (Relationship, Full Name, Address,
SSN/EIN/Tax ID, DOB, Trustee/Executor Name, Percentage Share, Claim Number)

Other Interested Parties (information that may be collected via forms about third parties that have
an interest or involvement in a specific hiring action)
•
•
•

•
•
•
•
•

Witnesses to Signatures (Full Name, Title, Office, Address, Signature, Date,
Commission Expiration Date)
Emergency Contact (Full Name, Relationship to Employee, Phone)
Foreign Relative or Associate (Full Name, Address, Type of Relation, Gender,
Citizenship Code Number, Place of Birth, DOB, SSN, Employer Information, Degree
and Method of Contact, Date of Last Contact, U.S. Naturalization Information, Date of
Entry into U.S., Alien Registration Number, Additional Information)
Requestor Information (Full Name, Address, Title, Military Status, Signature and Date)
Preparer/Translator Information (Full Name, Address, Phone, Title, Signature and
Date)
Job Counselor Information (Full Name, Address, Phone, Email)
Approver Information (Decision, Decision Date, Full Name, Title, Signature and Date)
Document Verifier Information (Full Name, Title, Organization, Address, Signature
and Date)

Background and Suitability Information
•
•
•
•
•
•

Conviction, imprisonment, probation, or paroled in last 7 years (Y/N)
Convicted by a military court in last 7 years (Y/N)
Currently under charges for any violation of law (Y/N)
Fired from job, or quit for performance-based reasons, or debarred from federal
employment in last 7 years (Y/N)
Delinquent on any federal debt (Y/N)
Any relatives that work for agency to which form is being submitted (Y/N)

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 27

•
•
•
•
•
•
•
•

•

Receive, or ever applied for, retirement pay, pension, or other retired pay (Y/N)
Date Left Last Federal Job (Month, Day, Year)
Waive Basic Life Insurance When Last Worked for Federal Government (Y/N)
Familiar with Protected Critical Infrastructure Information (initial in box)
Familiar with Sensitive Security Information (initial in box)
Familiar with Other Sensitive but Unclassified Information (initial in box)
Does resume submitted with application list all Federal Government Civilian and
uniformed service (Y/N)
Citizenship Status of Relatives and Associates (various questions related to whether
applicant or spouse has relatives or associates that live or work, or that were born,
outside of the United States)
Drug History/Testing (various questions related to purchase, use, sale, cultivation, and
distribution of drugs)

2.2

What are the sources of the information and how is the
information collected for the project?

SMORE collects information from attendees at recruitment events and from registrants at
recruitment webinars. Information is also collected from job applicants, either directly or via
uploaded resumes and forms, when they apply for positions in USAJOBS. Additionally,
information is collected from job candidates via forms they submit into the online portals of USA
Staffing and CASS once they receive TJOs and FJOs. Furthermore, information is collected from
new hires via forms they complete at their new employee orientation. Finally, information about
applicants is collected from certain third parties involved in the Talent Acquisition process such
as HR specialists, PerSec personnel, and background investigators.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 28

2.3

Does the project use information from commercial sources or
publicly available data? If so, explain why and how this
information is used.

No. All information collected by OCHCO and Component HR offices is collected from the
data subjects themselves. 44

2.4

Discuss how accuracy of the data is ensured.

HR specialists and others involved in the Talent Acquisition process rely on the data
subjects themselves to provide information. If inaccuracies in the information they provide result
in an inability to process onboarding functions such as setting up payroll or establishing benefits,
the HR specialist handling the function will reach back to the data subject with a request to correct.

2.5

Privacy Impact Analysis: Related to Characterization of the
Information.

Privacy Risk: There is a risk that HR specialists and others involved in the Talent
Acquisition function may be able to access information about individuals they do not need in the
performance of their duties.
Mitigation: This risk is mitigated. A feature in both USA Staffing and CASS allows HR
specialists to permit or deny hiring managers and others involved in the Talent Acquisition process
the ability to view specific supporting documents. HR specialists are trained to hide from view any
documents that contain SPII and that are unrelated to the role of the individual with which the
information is shared. Forms completed at new employee orientation are immediately routed to
the individuals responsible for processing them and all records retention, storage, and disposal
procedures are followed.
Privacy Risk: There is a risk that HR specialists will collect more information about
individuals than is needed to successfully execute the Talent Acquisition function.
Mitigation: This risk is mitigated. The Talent Acquisition workflow is designed to only
collect information at the point at which it is required. For example, information required to
conduct pre-suitability checks and background investigations is only collected from those who
receive TJOs since that is the point on the workflow where these processes commence. Similarly,
information collected to process benefits is only collected from those who receive FJOs and who

Although OPM and PerSec do collect publicly available data when conducting background investigations and preemployment suitability checks, this collection is not considered part of the HCBRM Talent Acquisition function. For
more information about this collection, see supra note 28.

44

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 29

attend new employee orientation since that information is only necessary from individuals who
ultimately become DHS employees.
Privacy Risk: There is a risk that DHS will maintain inaccurate information about job
applicants and candidates.
Mitigation: This risk is partially mitigated. HR specialists and others involved in the
Talent Acquisition process rely on the applicants themselves to provide information. If
inaccuracies in the information individuals provide result in an inability to process onboarding
functions such as setting up payroll or establishing benefits, the HR specialist handling the function
will reach back to the individual with a request to correct. Additionally, applicants may update and
change their profiles in USAJOBS, USA Staffing, and CASS at any time to ensure data quality
and integrity of their application profiles. Furthermore, individuals may file a Privacy Act request
with DHS or OPM to access and correct their personnel records, as applicable.

Section 3.0 Uses of the Information
3.1

Describe how and why the project uses the information.

OCHCO and Component HR offices coordinate the Talent Acquisition function for all job
applicants and prospective and newly-appointed employees. These hiring authorities use this
information to fill vacancy announcements, produce certificates of eligible, extend TJOs and
FJOs, collect information necessary for PerSec to conduct pre-employment suitability checks and
background investigations, and process new-hires into the Department. Most of the information
collected is PII and SPII. SSNs are necessary to verify employment eligibility and to allow
applicants to receive pay, to pay taxes, and to obtain benefits. New hire information is used by
HR specialists working in benefits processing to enroll new employees in government benefit and
direct deposit programs during their first pay period as a DHS employee.

3.2

Does the project use technology to conduct electronic searches,
queries, or analyses in an electronic database to discover or locate
a predictive pattern or an anomaly? If so, state how DHS plans to
use such results.

No. DHS’s Talent Acquisition function does not rely on technology to conduct electronic
searches, queries, or analyses in electronic databases to discover or locate predictive patterns or
anomalies.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 30

3.3

Are there other components with assigned roles and
responsibilities within the system?

DHS’s Talent Acquisition function is performed in conjunction with OPM and NFC; and
is supported by various online, browser-based tools that those agencies provide DHS to determine
eligibility of applicants for federal employment and to process payroll and benefits. DHS HR
Offices are separated by Component, with each having its own instances of these OPM and NFC
systems. CASS, which is a vendor-managed system, is also comprised of Component-specific
instances. Although HR specialists across Components can access CASS, OPM’s USA Staffing
and eOPF systems, or NFC’s EmpowHR and WebTA systems, they can only access the data of
applicants, candidates, and employees of their Components.
OCHCO and Component HR offices also rely on their own Component PerSec Offices to
conduct pre-employment suitability checks and background investigations. Again, information is
only shared between the HR Offices and the PerSec Offices of the Components to which the
applicants are applying.

3.4

Privacy Impact Analysis: Related to the Uses of Information

Privacy Risk: There is a risk that applicant and new employee information may be used in
a manner inconsistent with the original purpose for collection.
Mitigation: This risk is mitigated. All files and records are collected and maintained by
Component HR offices in accordance with OPM regulations and instructions. These files are only
used to meet OPM personnel requirements, including screening qualifications of employees;
determining status, eligibility, and employee’s rights and benefits under pertinent laws and
regulations governing federal employment; computing length of service; and other information
needed to provide hiring and personnel services to job applicants and new employees. All HR
personnel also complete annual privacy training that discusses proper use and disclosure of PII.
HR specialists who use applicant and new employee data in a manner inconsistent with these OPM
regulations are subject to discipline, up to and including removal.
Privacy Risk: There is a risk of individuals gaining unauthorized access to information in
systems that support DHS’s Talent Acquisition function.
Mitigation: This risk is mitigated. Information security and policy controls for all HR
systems must comply with DHS 4300A, Sensitive System Handbook. 45 Specific controls include
DHS 4300 is a series of information security policies, which are the official documents that create and publish
Departmental security standards in accordance with DHS Management Directive 140-01, Information Technology
System Security. See U.S. DEPARTMENT OF HOMELAND SECURITY, DHS 4300A SENSITIVE SYSTEMS HANDBOOK,
available at https://www.dhs.gov/publication/dhs-4300a-sensitive-systems-handbook (last accessed August 9,
2020).
45

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 31

role-based access to systems only on a need to know basis and subject to the approval of the system
owner and system administrators. Password resets are also periodically required, and accounts are
disabled upon expiration.
Privacy Risk: There is a risk that incorrect information in employee records contained in
HR systems supporting the Talent Acquisition function could lead to faulty or unjust personnel
decisions.
Mitigation: This risk is mitigated. Applicants are notified when a negative determination is
made regarding their application and the reasons for the determination. Hiring authorities are
subject to legal liability if a determination is made contrary to OPM or DHS regulation, and
applicants are encouraged to follow up via phone or email with the HR specialist handling their
application if they are not satisfied with the negative determination. Additionally, PerSec notifies
applicants with a certified letter that includes procedures for redress once their background
investigation has concluded.
Regarding information collected from new hires for onboarding functions such as setting up
payroll or establishing benefits processing, HR specialists upload an original copy of the relevant
employee forms in DHS IT systems and eOPF, as appropriate. Employees are then able to file a
ticket within these systems to request that an HR specialist review their profile within NFC’s
payroll system if they suspect an inaccuracy or a faulty decision. Hiring authorities are subject to
legal liability if they make a payroll or benefits determination contrary to federal law or regulation.

Section 4.0 Notice
4.1

How does the project provide individuals notice prior to the
collection of information? If notice is not provided, explain why
not.

Notice is provided at the time of collection via Privacy Act Statements, which are available
during recruitment events, on the USAJOBS website, and on forms submitted into the USA
Staffing and CASS online portals where required. Privacy Act Statements also appear on all forms
completed by the applicant for background investigations and security clearance checks. The
Privacy Act Statements inform individuals of the authority for and purpose of the collection, the
uses of the information, and whether providing the information is mandatory. Notice is also
provided by this PIA, as well as the publication of the SORNs identified in Section 1.2.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 32

4.2

What opportunities are available for individuals to consent to
uses, decline to provide information, or opt out of the project?

Applicants have the flexibility to decline to provide any their information for any job
announcement by choosing not to participate in the hiring process for that employment
opportunity. For those that do decide to submit their information for a job announcement, they
nonetheless may opt to decline providing certain demographic information about themselves as
part of the initial application questionnaire. New hires may also decline to provide their
information by opting to participate only in the benefit programs of their choosing.
However, as a requirement for employment, DHS must collect most of the information
listed above.

4.3

Privacy Impact Analysis: Related to Notice

Privacy Risk: There is a risk that applicants and new hires will not receive adequate notice
detailing the purpose for the collection of their information, as well as its use, maintenance, and
dissemination.
Mitigation: This risk is mitigated. Privacy Act Statements are provided to applicants and
new hires at the time they submit their information during recruiting events, through USAJOBS,
or on online HR portals, and whenever they submit forms for onboarding processing or to facilitate
pre-employment suitability checks and background investigations. This risk is also mitigated by
publication of this PIA and the SORNs identified in Section 1.2.

Section 5.0 Data Retention by the project
5.1

Explain how long and for what reason the information is retained.

Records related to OPM’s HCBRM Talent Acquisition function are generally covered by
NARA GRS 2.1, Employee Acquisition Records, and certain records created during the
onboarding process are covered under NARA GRS 2.2, Employee Management Records.
GRS 2.1 explicitly states its purpose, which is to cover records agencies create in the
process of hiring employees for federal civilian service, whether career service, senior executive
service, political appointment, excepted service appointment, or temporary/special appointment.
The schedule also states that it reflects OPM’s determinations on appropriate records retention
periods for the sake of agencies for which OPM exercises oversight authority (of which DHS is
one). The specific retention periods for the categories of information covered under this schedule
are as follows:

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 33

Item Records Description

Disposition Instruction

010

Classification Standards – Correspondence and other
records relating to developing classification standards
specific to a single agency or all agencies, including notice of
Office of Personnel Management (OPM) approval or
disapproval.

Temporary. Destroy 2
years after standard is
superseded, canceled, or
disapproved by OPM (as
appropriate) but longer
retention is authorized if
required for business use.

020

Position Descriptions:
Records relating to developing,
editing, classifying, and
evaluating position
descriptions, including
information on title, series,
grade, duties, and
responsibilities

Official record copy of
position description. Copy
held at Human Resources
Office.

Temporary. Destroy 2
years after position is
abolished or description is
superseded, but longer
retention is authorized if
required for business use.

Copies in employee
Official Personnel File
(OPF), Unofficial
Personnel File (UPF) and
supervisor’s personnel
file.

Destroy in accordance
with disposal instructions
for associated file (See
GRS 2.2 section on
OPFs).

All other related records.
Includes case file at
position’s program office;
background material in
Human Resources case file;
other copies of records in
item 020.

Temporary. Destroy
when position description
is final, but longer
retention is authorized if
required for business use.

021

022

030

Position reviews and classification appeals. Records an
agency creates and receives when reviewing a position’s
classification in response to a classification appeal to the
agency Human Resources function or directly to OPM,
including records of desk audits.

Temporary. Destroy 3
years after final decision,
but longer retention is
authorized if required for
business use.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 34

040

Certificates of classification. Certificates a Federal agency
receives from OPM, stating final decision on a position
classification appeal.

Temporary. Destroy 2
years after position is
abolished or description is
superseded, but longer
retention is authorized if
required for business use.

050

Job vacancy case files. Case
files an agency creates when
posting and filling competitive
job vacancies. Also known as
case examining, competitive
examination, or merit case
files. Includes: request for lists
of eligible candidates; job
announcement; examination
announcement; job analysis,
assessment criteria, and
crediting plan; basis for
certification; applications,
resumes, supplemental forms,
other attachments; list of
eligible candidates or
applicants screened, ranking or
ratings assigned, and basis for
certification; certificates,
registers or lists of eligible
candidates issued to selecting
officials; job-related test
records; mandatory applicant
drug test records; annotated
certificates of eligible
candidates returned by
selecting officials; job offers;
records of job offer being
accepted or declined;
correspondence/documentation

Records of one-time
competitive and Senior
Executive Service
announcements/selections.

Temporary. Destroy 2
years after selection
certificate is closed or a
final settlement of any
associated litigation;
whichever is sooner.

Records of standing
register competitive files
for multiple positions
filled over a period of
time.

Temporary. Destroy 2
years after termination of
register.

051

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 35

of announcement or recruiting
operation.
060

Job application packages. Application packages for
competitive positions; in USAJOBS or its successors, and
other systems, whether electronic or analog. Includes:
application, resume, supplemental forms, other attachments.

Temporary. Destroy 1
year after date of
submission.

070

Case files on lost or exposed job test materials. Files
showing the circumstances of loss, nature of the recovery
action, and corrective actions when Civil Service or jobspecific test questions are erroneously made potentially
available to candidates.

Temporary. Destroy 5
years after date of final
report.

080

Requests for non-competitive personnel action. Agency
copy of requests submitted to OPM for approval for noncompetitive personnel action on such matters as promotion,
transfer, reinstatement, or change in status.

Temporary. Destroy 1
year after approval is
granted or denied.

090

Interview records. Case files related to filling job vacancies,
held by hiring official and interview panel members.
Includes: copies of records in the job vacancy case file; notes
of interviews with selected and non-selected candidates;
reference check documentation.

Temporary. Destroy 2
years after case is closed
by hire or non-selection,
expiration of right to
appeal a non-selection, or
final settlement of any
associated litigation,
whichever is later.

100

Political appointment
(Schedule C) records.
Records regarding evaluation
of individuals’ suitability for
non-career positions by noncompetitive appointment under
Schedule C. Includes:
applications for employment;
resumes; individuals’
background information; ethics
pledges and waivers; security
clearances; correspondence;

Records (except ethics
pledges and waivers)
related to appointees.

Temporary. Destroy after
separation. Retention up
to end of administration
under which individual
was hired is authorized if
required for business use.

Ethics pledges and
waivers of appointees.

File in appointee’s
Official Personnel File.

Records related to nonappointees

Temporary. Destroy 1
year after consideration of
the candidate ends.

101
102

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 36

other documentation relating to
the selection, clearance, and
appointment of political
appointees
110

111

Excepted service
appointment records.
Records created in filling
permanent or temporary job
vacancies by non-competitive
appointment under Schedules
A, B, or D (as defined in 5
CFR 213.3101, 3201, 3303,
and 3401). Includes (as
appropriate): application,
attachment, and supplemental
forms; documentation of
eligibility for excepted service
appointment; proof of special
qualifications; resume or other
proof of employment
education, or relevant
experience; proof of disability
issued by a licensed medical
professional; certification of
job readiness; notice of
appointment, terms, and
acceptance.

Retention up to end of
administration under
which individual was
considered is authorized if
required for business use.
Case files that document
appointing individuals
with intellectual
disabilities, severe
physical disabilities, or
psychiatric disabilities as
defined in 5 CFR
213.3102(u).

Temporary. Destroy 5
years after candidate
enters on duty, is no
longer under
consideration, or declines
offer.

Case files related to all
other appointees.

Temporary. Destroy 2
years after hiring
authority closes but longer
retention is authorized if
required for business use.

120

Special hiring authority program records. Records an
agency creates and receives that document its administration
of special hiring authority programs such as summer, student,
intern, and other temporary hiring authorized by OPM.

Temporary. Destroy 2
years after hiring
authority closes but longer
retention is authorized if
required for business use.

130

Records related to individual employees hired under
special temporary authority. Includes participant
agreement, records of mentoring, documentation that

Temporary. Destroy 2
years after employee is
converted to a permanent

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 37

140

141

employee fulfilled educational and other requirements, and
conversion to a permanent position.

position or leaves a
program but longer
retention is authorized if
required for business use.

Pre-appointment files.
Records created when vetting a
prospective employee between
the time a job offer is accepted
and the time employee enters
on duty.

Records documenting
background investigation
or vetting of prospective
employees to determine
eligibility for security
clearance and sensitive
positions. Included are
forms in the SF-85 family,
fingerprint charts, and
related correspondence.

Forward to appropriate
security office after
prospective employee
enters on duty, declines
appointment, or is no
longer a candidate.

Records appropriate for
inclusion in OPF. Such as
designation of beneficiary,
life insurance election, and
health benefits registration.

Records concerning
prospective employees
who enter on duty:
Forward to appropriate
human resources office to
include in OPF after
employee enters on duty.
Records concerning
prospective employees
who do not enter on
duty: Temporary.
Destroy 1 year after
employee is no longer a
candidate.

142

143

Copies of records
included in Job vacancy
case file.

150

Records of delegation of authority for examination and
certification. Agreements and related records created under

Temporary. Destroy after
prospective employee
enters on duty, declines
appointment, or is no
longer a candidate.
Temporary. Destroy 3
years after agreement

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 38

the authority of 5 U.S.C. § 1104 by which OPM delegates to
an agency the authority to examine and certify applicants for
employment.

terminates but longer
retention is authorized if
required for business use.

160

Delegated authority audits. Reports of delegated examining
operations audit delivered to the audited agency.

Temporary. Destroy
when 3 years old, but
longer retention is
authorized if required for
business use.

170

Adverse impact files. Records
documenting the impact of
tests and other selection
procedures on peoples’
employment opportunities,
recorded by sex, race, and
ethnic group in order to
determine compliance with the
Uniform Guidelines on
Employee Selection
Procedures. Includes records
documenting: number of
applicants by sex, race, and
national origin; number of
people hired, promoted, and
terminated, by sex, race, and
national origin; selection
procedures and their validity.

Records revealing no
adverse impact.

Temporary. Destroy
when 3 years old, but
longer retention is
authorized if required for
business use.

Records revealing an
adverse impact.

Temporary. Destroy 2
years after eliminating the
adverse impact, but longer
retention is authorized if
required for business use.

171

180

Recruitment records. Records documenting agency inperson and online recruitment efforts at career fairs, job fairs,
visits to colleges, and similar venues. Includes: records
documenting planning and logistics of individual recruitment
events; record copy of advertisement and materials for
distribution; contact information and interest areas collected
from potential job candidates; recruitment event reports;
correspondence with prospective candidates.

Temporary. Destroy
when 1 year old, but
longer retention is
authorized if required for
business use.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 39

GRS 2.2 covers records federal agencies create while carrying out the work of employees,
including the processing of certain personnel actions created during the onboarding process. The
retention periods under this schedule specific to certain onboarding documents include:
Item

Records Description

040

Official Personnel Folder
(OPF)/electronic OPF (eOPF).
The Official Personnel Folder
(SF-66) or its approved
electronic equivalent documents
an individual’s employment
history.

041

Disposition Instruction
Long-term records.
Records of separated
employees saved to the
“permanent” folder in the
eOPF or filed on the right
side of the hardcopy
OPF.

Temporary. Destroy
when survivor or
retirement claims are
adjudicated or when
records are 129 years
old, whichever is
sooner, but longer
retention is authorized if
required for business
use.

Short-term records.
Records of separated
employees saved to the
“temporary” folder in the
eOPF or filed on the left
side of the hardcopy
OPF.

Temporary. Destroy
when superseded or
obsolete, or upon
separation or transfer of
employee, whichever is
earlier.

050

Notifications of personnel actions.
Temporary. Destroy
when business use
Copies of SF-50, documenting all individual personnel
actions such as hiring, promotions, transfers, and separation. ceases.
Includes chronological files, fact sheets, general
correspondence, and forms about pending personnel actions
maintained by agency Human Resources offices.

060

Employment eligibility verification records.
Employment Eligibility Verification form I-9 and any
supporting documentation.

Temporary. Destroy 3
years after employee
separates from service
or transfers to another
agency.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 40

5.2

Privacy Impact Analysis: Related to Retention

Privacy Risk: There is a risk that the information collected when executing the Talent
Acquisition function will be retained longer than is necessary to accomplish a legitimate purpose,
or inconsistently with the records retention schedule.
Mitigation: This risk is mitigated. All offices throughout DHS are required to comply with
relevant records management guidance. When feasible, technical mechanisms are built into
systems and tools to allow for the automatic purging of data as appropriate. Standard Operating
Procedures (SOP) and manual purging requirements are followed otherwise.
In the case of records pertaining to Talent Acquisition, DHS adheres to GRS 2.1. This GRS
aligns with governing OPM regulations as OPM exercises oversight authority over DHS’s Talent
Acquisition processes and activities. DHS has a Department-wide records manager in its
Headquarters OCIO whose job it is to promote compliance with all relevant records schedules
across the Department. OCHCO also has an office-wide records manager, and each OCHCO
division has a records custodian who manages day-to-day records compliance duties within that
division and who reports to the office-wide records manager insofar as their records management
role is concerned. Component HR offices are responsible for ensuring their own records
management compliance but are nonetheless required to adhere to GRS 2.1.

Section 6.0 Information Sharing
6.1

Is information shared outside of DHS as part of the normal
agency operations? If so, identify the organization(s) and how the
information is accessed and how it is to be used.

Information is routinely shared with OPM as the primary Human Capital authority for
civilian federal agencies and with NFC for purposes of onboarding functions such as setting up
payroll or benefits processing. This sharing is consistent with 5 U.S.C. § 552a(b)(3), under the
applicable SORN, which permits the following sharing:
1) To obtain and disclose information to OPM as part of the candidate selection process
through various staffing tools (e.g., USAJOBS, CASS, USA Staffing, USA Hire);
2) To disclose information to process payroll and benefit payroll deduction information
for employees;
3) To disclose information to government training facilities (federal, state, local) and to
non-government training facilities (e.g., private vendors of training courses or
programs, private schools) for training purposes;
4) To disclose information to education institutions on appointment of a recent graduate
to a position in the federal service, and to provide college and university officials with

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 41

information about their students working in the Pathways Program, Volunteer Service,
or other similar programs necessary to a student’s obtaining credit for the experience
gained;
5) To disclose information necessary to FEGLI to verify election, declination, or waiver
of regular and/or optional life insurance coverage or eligibility for payment of a claim
for life insurance;
6) To disclose, to health insurance carriers contracting with OPM to provide a health
benefits plan under the FEHB program, information necessary to identify enrollment
in a plan, to verify eligibility for payment of a claim for health benefits, or to carry out
the coordination or audit of benefit provisions of such contracts.
7) To disclose information to a federal, state, or local agency for determination of an
individual’s entitlement to benefits in connection with Federal Housing Administration
programs;
8) To consider and select employees for incentive awards and other honors and to
publicize those granted. This may include disclosure to other public and private
organizations, including news media, that grant or publicize employee recognition;
9) To consider employees for recognition through quality step increases, and to publicize
those granted. This may include disclosure to other public and private organizations,
including news media, that grant or publicize employee recognition;
10) To disclose information to officials of labor organizations recognized under 5 U.S.C.
§ chapter 71 when relevant and necessary to their duties of exclusive representation
concerning personnel policies, practices, and matters affecting working conditions;
11) To disclose information to officials from agencies who have oversight, as appropriate.
These agencies include, but are not limited to: OPM, the Merit Systems Protection
Board (MSPB), the Federal Labor Relations Authority (FLRA), the Government
Accountability Office (GAO), and the Equal Employment Opportunity Commission
(EEOC); and
12) To disclose the results of a drug test of a federal employee pursuant to an order of a
court of competent jurisdiction when required by the U.S. Government to defend
against any challenge against any adverse personnel action.

6.2

Describe how the external sharing noted in 6.1 is compatible with
the SORN noted in 1.2.

The SORNs applicable to records covered by the Talent Acquisition function permit the
sharing of personnel and organizational records with external entities. The routine uses in the
SORNs define the circumstances for when information may be shared externally. A complete list

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 42

of the routine uses can be found in the appropriate SORNs listed in Section 2.1. The following are
examples of information sharing permitted by routine uses:
•

•

•

•

•

•

Information may be shared with the Office of Federal Employees Group Life Insurance to
verify election, declination, waiver of regular and/or optional life insurance coverage, or
eligibility for payment of a claim for life insurance, or to TSP to verify election change and
designation of beneficiary (Routine Use E, OPM/GOVT-1).
Information may be shared with health insurance carriers contracting with OPM to provide
a health benefits plan under the Federal Employees Health Benefits Program, information
necessary to identify enrollment in a plan, to verify eligibility for payment of a claim for
health benefits, or to carry out the coordination or audit of Benefit provisions of such
contracts (Routine Use F, OPM/GOVT-1).
Information may be shared with any source from which additional information is requested
(to the extent necessary to identify the individual, inform the source of the purpose(s) of
the request, and to identify the type of information requested), when necessary to obtain
information relevant to an agency decision to hire or retain and employee, issue a security
clearance, conduct a security or suitability investigation of an individual, classify jobs, let
a contract, or issue a license, grant, or other benefits (Routine Use L, OPM/GOVT-1).
Information may be shared with a federal agency in the executive, legislative, or judicial
branch of government, in response to its request, or at the initiation of the agency
maintaining records, information in connection with the hiring of an employee, the
issuance of a security clearance or determination concerning eligibility to hold a sensitive
position, the conducting of an investigation for purposes of a credentialing, national
security, fitness, or suitability adjudication concerning an individual, the classifying or
designation of jobs, the letting of a contract, the issuance of a license, grant, or other benefit
by the requesting agency, or the lawful statutory, administrative, or investigative purpose
of the agency to the extent that the information is relevant and necessary to the requesting
agency’s decision (Routine Use M, OPM/GOVT-1).
Information may be shared with federal agencies to refer applicants, including current and
former federal employees, for consideration for employment, transfer, reassignment,
reinstatement, or promotion (Routine Use A, OPM/GOVT-5).
Information may be shared with a federal agency, in response to its request, in connection
with hiring or retaining an employee, issuing a security clearance, conducting a security or
suitability investigation of an individual, classifying positions, letting a contract, or issuing
a license, grant, or other benefit by the requesting agency, to the extent that the information
is relevant and necessary to the requesting agency’s decision in the matter (Routing Use E,
OPM/GOVT-5).

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 43

•

•

Information may be shared with federal, state, local, tribal, foreign or international agency,
if the information is relevant and necessary to a requesting agency’s decision concerning
the hiring or retention of an individual, the issuance of a security clearance, license,
contract, grant, delegation or designation of authority, or other benefit, or if the information
is relevant and necessary to a DHS decision concerning the hiring or retention of an
employee, the issuance of a security clearance, the reporting of an investigation of an
employee, the letting of a contract, or the issuance of a license, grant, delegation or
designation of authority, or other benefit and disclosure is appropriate to the proper
performance of the official duties of the person making the request (Routine Use H,
DHS/ALL-023).
Substance abuse records may be shared with medical personnel to the extent necessary to
meet a bona fide medical emergency; with qualified personnel for the purpose of
conducting scientific research, management audits, financial audits, or program evaluation
provided that employees are individually identified; to the employee’s medical review
official; to the administrator of any Employee Assistance Program in which the employee
is receiving counseling or treatment or is otherwise participating; to any supervisory or
management official within the employee’s agency having authority to take adverse
personnel action against such employee; or pursuant to the order of a court of competent
jurisdiction where required by the federal government to defend against any challenge
against any adverse personnel action (Routine Uses A-F, DHS/ALL-022).

6.3

Does the project place limitations on re-dissemination?

Yes. Some of the information collected, maintained, used, and disseminated by DHS when
executing the Talent Acquisition function is shared with OPM and NFC. Those agencies are bound
by the Privacy Act and other relevant federal information governance laws and regulations in the
same way as DHS to limit further dissemination of the information.

6.4

Describe how the project maintains a record of any disclosures
outside of the Department.

DHS, OPM, and NFC systems use auditing tools and procedures to ensure accountability
of access by users, to reconstruct events, to detect intrusions, and to identify problems. All the
systems that support Talent Acquisition comply with National Institutes of Standards and
Technology (NIST) security controls. All systems also have audit trail records that are maintained
online for a brief period, are periodically reviewed by system personnel, and are preserved for the
periods prescribed in the associated records retention schedules.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 44

6.5

Privacy Impact Analysis: Related to Information Sharing

Privacy Risk: There is a risk that individuals authorized to access information collected to
support DHS’s Talent Acquisition function will share information with unauthorized recipients.
Mitigation: This risk is mitigated. All information collected, maintained, used, and
disseminated by DHS when executing the Talent Acquisition function is covered by the Privacy
Act. As such, information is only disseminated consistent with the routine uses identified in the
above SORNs. All HR personnel also complete annual privacy training that discusses proper use
and disclosure of PII. Any employee who shares information in an unauthorized fashion is subject
to discipline, up to and including removal. Additionally, all user accounts for systems that support
Talent Acquisition require approval from the system owner and the ISSO. These systems also have
audit logs that collect details on who accessed the system and when.

Section 7.0 Redress
7.1

What are the procedures that allow individuals to access their
information?

Applicants may access their profiles within USAJOBS at any time. Employee records
collected, maintained, used, and disseminated by DHS are covered by the Privacy Act. Employees
may file a Privacy Act or Freedom of Information Act (FOIA) request with DHS or OPM to access
their personnel records. If an individual would like to file a Privacy Act or FOIA request to view
his or her record, he or she may mail the request to the following address (or applicable
Component):
Chief Privacy Officer/Chief Freedom of Information Act Officer
Privacy Office, Mail Stop 0655
Department of Homeland Security
2707 Martin Luther King, Jr. Avenue SE
Washington, D.C. 20528-065
These requests must be in writing and include the requestor’s daytime phone number, email
address, and as much information as possible of the subject matter to expedite the search process.
Specific Component FOIA contact information can be found at http://www.dhs.gov/foia under
“Contact Information.” 6 CFR Part 5, Subpart B, provides the rules for requesting access to Privacy
Act records maintained by DHS.

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 45

In addition, employees may access personnel data about themselves via NFC’s Employee
Self Service page (MyEPP). 46

7.2

What procedures are in place to allow the subject individual to
correct inaccurate or erroneous information?

Applicants may update and change their profiles within USAJOBS at any time. If an
applicant knows of any inaccurate or erroneous information about himself or herself in any of the
other systems that support Talent Acquisition, the individual may contact the HR specialist
handling the application who will liaise with the appropriate personnel to correct the information.
New hires may also contact HR specialists within their office and Component to correct inaccurate
or erroneous information, or they may submit an HR ticket through FedHR Navigator to request
correction of inaccurate or erroneous information.

7.3

How does the project notify individuals about the procedures for
correcting their information?

Applicants are provided with the name, phone number, and email of an HR specialist who
serves as the primary point of contact for a specific job announcement via USAJOBS. The
applicant and the HR specialist are in regular communication between the time the applicant
receives a TJO and the time the applicant attends new employee orientation. For new hires, each
DHS organization has one or more designated HR specialists to assist with HR needs. The names
and titles of these individuals are common knowledge throughout organizations and are reflected
on organization charts. Employees may also reach out to OCHCO or any of the Component Human
Capital Offices using the general HR phone numbers and email addresses posted on the DHS
employee intranet site. Additionally, they may submit an HR service ticket through FedHR
Navigator to correct inaccurate information, or they may correct some of their personal
information themselves via NFC’s MyEPP. Links to FedHR Navigator and MyEPP are
prominently displayed on the DHS employee intranet homepage.

7.4

Privacy Impact Analysis: Related to Redress

Privacy Risk: There is a risk that applicants and employees will not be able to access,
correct, or amend their application and onboarding materials and forms.
Mitigation: This risk is mitigated. Applicants can correct and amend information they
submit directly in USAJOBS. They may also contact the HR specialist handling their applications
to pursue correction of information. New hires can additionally use MyEPP to update and correct
See NATIONAL FINANCE CENTER, FEDERAL HUMAN CAPITAL BUSINESS REFERENCE MODEL (HCBRM), MY
EMPLOYEE PERSONNEL PAGE, available at https://www.nfc.usda.gov/EPPS.
46

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 46

their personnel data. Like applicants, new hires and employees also have HR representatives
assigned to them who can assist with all types of HR matters. Moreover, all government personnel
records are covered by the Privacy Act, and fall under the general personnel records SORNs
managed and maintained by DHS and OPM. There are Privacy Act Statements on all OPM and
DHS IT systems that alert candidates and new employees that their records are afforded Privacy
Act protections.

Section 8.0 Auditing and Accountability
8.1

How does the project ensure that the information is used in
accordance with stated practices in this PIA?

OCHCO has a Privacy SOP that aligns with all the information management practices
covered in this PIA. Components have similar guidance that ensures information is managed in
accordance with laws, regulations and policies, including those issued by the DHS Privacy Office.
Additionally, HR specialists who handle applicant and new hire information have specific roles in
the Talent Acquisition process and are only provided information that is directly related to those
roles. Similarly, access to systems that support Talent Acquisition are determined by the role to be
performed by the user. In this way, the information viewed by the privileged or general user is
based on the role being performed and the “need to know” principle. Audit trails are also reviewed
to ensure the appropriate handling of information.

8.2

Describe what privacy training is provided to users either
generally or specifically relevant to the project.

All OCHCO and Component HR personnel complete Privacy and IT Security Awareness
Training at least annually. System, database, and application administrators also must complete
privileged user training, system administrator training, and incident response training prior to
assuming those roles. Additionally, DHS conducts annual audits, and HR specialists complete
DHS certification training consistent with OPM’s Delegated Examining Operations Handbook. 47
DHS hiring authorities must also establish an internal accountability system and conduct annual
self-audits of delegated examining activities.

See U.S. OFFICE OF PERSONNEL MANAGEMENT, DELEGATED EXAMINING OPERATIONS HANDBOOK: A GUIDE FOR
FEDERAL AGENCY EXAMINING OFFICES (JUNE 2019), available at https://www.opm.gov/policy-dataoversight/hiring-information/competitive-hiring/deo_handbook.pdf.
47

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 47

8.3

What procedures are in place to determine which users may
access the information and how does the project determine who
has access?

All DHS HR offices manage their own employee access to OPM and NFC systems, as well
as user accounts for their internal HR IT systems. Users are required to attend role-based security
training and sign Rules of Behavior and a DHS Non-Disclosure Agreement prior to being granted
access to systems. They are also required to annually complete privacy and IT security awareness
training.

8.4

How does the project review and approve information sharing
agreements, MOUs, new uses of the information, new access to the
system by organizations within DHS and outside?

All information sharing agreements with OPM and NFC are reviewed and approved by the
individual HR offices for consistency with applicable laws, regulations, and policies governing the
appropriate sharing of information outside the Department. The DHS Privacy Office and
Component Privacy Offices are engaged when appropriate.

Responsible Official
Donna Seymour
Director, Human Capital Business Solutions
Office of the Chief Human Capital Officer
U.S. Department of Homeland Security
(202) 357-8375

Approval Signature
Original, signed copy on file with the DHS Privacy Office.
_______________________
Dena Kozanas
Chief Privacy Officer
U.S. Department of Homeland Security
(202) 343-1717

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 48

Appendix
(last updated March 14, 2023)
The following IT systems are used by DHS hiring authorities for the collection, use, dissemination,
and maintenance of information from members of the public during the hiring and onboarding
process in addition to the standard systems mentioned above and are covered by this PIA.
DHS Headquarters (DHS HQ)
HireVue is used to support the interview portion of DHS’s Talent Acquisition workflow.
HireVue has the capability to host video interviews and allows interviewees to schedule their own
interviews and conduct them either live or on their own time. HireVue assessments combine video,
scenario-based questions, and game-based technology with the objective of rapidly and accurately
identifying the best candidates while minimizing bias in the selection process. Live interviews use
audio and video to connect hiring managers and recruiters in real-time. On demand video
interviews allow candidates to interview on their own time by recording answers to job-relevant,
structured interview questions at their convenience and without the hiring manager’s presence.
The platform also allows for branded communications, candidate management dashboards, and
other features designed to simplify the hiring process and reduce time-to-hire. 48
U.S. Customs and Border Protection (CBP)
CBP Automated Testing Service (CATS) is a commercially-available automated system
that provides nationwide testing and proctored test administration services for CBP promotion
positions. The CBP Office of Human Resources Management (HRM) Personnel Research and
Assessment Division (PRAD) develops, implements, and analyzes assessments for selection,
career development, and promotion into mission critical occupations within CBP. CBP offers inperson proctored exams at vendor run test centers around the country as well as vendor supplied
remote proctored exams. CBP conducts remote exams using the CATS system, which records
video. Each year, CBP uses CATS to administer thousands of competency-based assessments to
CBP Officers, CBP Agriculture Specialists, Border Patrol Agents, Air Interdiction Agents,
Aviation Enforcement Agents, and Marine Interdiction Agents. The types of assessments
administered online via CATS include job knowledge tests, logical reasoning assessments, job

HireVue also offers the ability to leverage artificial intelligence to evaluate a candidate’s work style, how they
work with people, and general cognitive ability. DHS will not purchase or use any features that leverage artificial
intelligence as part of candidate assessments. All candidates will be assessed solely based on their answers to the
assessment questions and not on computer-aided analysis of eye movements, subtle and momentary facial
expressions, or other factors not typically considered during an in-person interview.

48

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 49

simulations, writing skills assessments, and writing samples. The following are user groups of
CATS:
•

•

•

DHS/CBP Employees and Applicants (members of the public): schedule testing
sessions, complete assessments during an in-person proctored test session or the vendor
supplied remote proctored online assessment, and access score reports. If an applicant
utilizes the option to take the assessment virtually, a proctor will join the scheduled
assessment virtually online, introduce themselves to the applicant and ask the applicant
to display a Driver’s License, State Issued ID, or Passport ID on the screen to allow the
proctor to verify the individual’s identity before the assessment begins. The
examination as well as the identification process are recorded through the vendor’s
software. Although the applicant’s ID is recorded in the video for auditing purposes,
the ID number is not tracked in the system. The audio and video recordings of remotely
proctored assessments, images of examinees, and images of examinees' identification
documents collected by the third-party vendor during promotional testing are stored on
the third-party vendor’s system for two months after the testing open period has
concluded.
CATS Contractor Personnel: program the assessments into the system, document
candidates’ attendance at their scheduled test session/site or participate in the vendor
supplied remote proctored online assessment, and report any issues encountered during
the session.
PRAD Staff: manage the testing program, retrieve candidate information, and verify
testing services provided.

U.S. Immigration Customs Enforcement (ICE) previously used CATS to facilitate the testing
process for promotions. As of June 1, 2018, only CBP uses CATS.
CBP Online Applicant Competency Assessment Service (COACA) is considered a
subsystem for CATS and is an automated system that provides nationwide testing and proctored
test administration services for CBP applicant positions. Applicants create a username and
password on the vendor-owned platform to login to the COACA system. CBP Office of Human
Resources Management (HRM) Personnel Research and Assessment Division (PRAD) develops,
implements, and analyzes assessments for entry-level selection and mission-critical occupations,
including Border Patrol Agents and CBP Officers. The type of assessments administered online
via COACA may be adaptive or non-adaptive tests. 49 The following are user groups of COACA:

A non-adaptive test (also known as static) is a fixed set of questions that vary in difficulty level, and every
applicant answers the same questions. An adaptive test (also called a Computer Adaptive Test or CAT) refers to a
test that has a large number of test questions of varying difficulty level.
49

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 50

• Applicants (members of the public): schedule testing session, request reasonable
accommodations (yes or no response only), complete assessments during a proctored
test session, and access score reports. If an applicant selects “yes” to request reasonable
accommodations, a system-generated email is sent to the PRAD staff. PRAD staff will
then reach out directly to the applicant and determine what accommodations are
requested.
• COACA Contractor personnel: program the assessments into the system, document
candidates’ attendance at their scheduled test session/site, and report any issues
encountered during the session.
• PRAD staff: manage the testing program, retrieve candidate information, manage
requests for reasonable accommodations, and verify testing services provided.
Cornerstone: Cornerstone 50 is a workflow tool and centralized repository that contains the
consolidated data from background check requests and results for CBP applicants and employees
to determine their suitability, or continued suitability, for employment or for a security clearance.
Human Resources Business Engine (HRBE): HRBE 51 is a web-based unified workflow
database for CBP human resources management to track entry-level and non-entry level hiring
processes. The human resources processes in HRBE include information about hiring and preemployment processing, labor and employee relations, performance management, random drug
testing, issue tracking, safety tracking, and change management.
HRM Online Applicant Interview Platform and Scheduling System (IPSS) is a cloudbased product procured to support the interview portion of CBP’s Talent Acquisition workflow to
schedule and conduct online interviews. The CBP Hiring Center will manually create a profile in
the system for applicants who are tentatively selected for a CBP position with an assessment or
interview requirement and the applicants will be able to complete their interview using the IPSS
platform. IPSS will allow CBP hiring managers to access candidate management dashboards and
interview schedules, conduct and record online interviews, view the applicant’s completed
assessment questions during the live interviews, and manually record the interview results. A
system interconnection between IPSS and HRBE will be set up to coordinate scheduling and
sharing the results for the online interviews. CBP will establish a system interconnection between
IPSS and Cornerstone, which will also feed the results of the applicant’s interview to DHS’s ISMS.

See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S. CUSTOMS AND BORDER PROTECTION,
PRIVACY IMPACT ASSESSMENT FOR THE CORNERSTONE, DHS/CBP/PIA-038, available at
https://www.dhs.gov/privacy-documents-us-customs-and-border-protection.
51
See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S. CUSTOMS AND BORDER PROTECTION,
PRIVACY IMPACT ASSESSMENT FOR THE HUMAN RESOURCES BUSINESS ENGINE (HRBE),
DHS/CBP/PIA-032, available at https://www.dhs.gov/privacy-documents-us-customs-and-border-protection.
50

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 51

Salesforce Background Investigation (BI) Tracking Application resides on the
Salesforce Government Cloud platform and is a data solution to centrally track the status of and
communication about the background investigation process for CBP contractor positions. While
the eQIP process is handled outside of the Salesforce BI Tracking system, the CBP Office of
Information and Technology (OIT) Workforce Management Division has the responsibility of
viewing and tracking the status of the eQIP process for all contractor candidates and notifying the
Contracting Officer Representative (COR), Project Managers, and candidates when there is a
status update received from the CBP Office of Professional Responsibility. The CBP OIT uses the
BI Tracking Application to gather data on candidates and streamline the process of uploading
necessary forms, routing candidates through the approval process, and coordinating necessary
information to provide greater visibility into the status of a contractor background investigation.
CBP is able to initiate a visitor request to grant candidates access to CBP buildings during
the BI process. CBP OIT enters details regarding the candidate’s visit in the system and the CBP
building guards are able to search the system to determine if the candidate has the ability to enter
the facility.
Salesforce Contact Center Application is used for CBP’s hiring call center, which allows
individuals and applicants to contact CBP to receive answers to questions about positions with
CBP or to keep track of their current application status. CBP will capture candidate and applicant
directed questions about CBP positions for queueing, upload necessary documentation to assist
candidates with the hiring process, and track follow up communication by the CBP Office of
Human Resources (HRM). The Salesforce Contact Center Application provides the ability to
create and track cases within the system associated with person accounts, and to provide responses
to individual candidates or applicants via email from the following address:
[email protected].
Application status information is automatically transmitted from HRBE and USA Staffing
to the Salesforce Contact Center Application. The Salesforce Contact Center Application will
display a view of an individual’s application status details from HRBE for all CBP applicants.
HRBE will send updates to Salesforce as they occur. A similar process will run to match applicant
data within USA Staffing with candidate data in Salesforce. If a match is found, the candidate will
be marked in Salesforce as having applied. CBP is also able to generate reports on the candidate
to applicant conversion rates to support marketing and advertising decisions based on this
information.
CBP has established an applicant portal utilizing a system interconnection between OPM’s
USAJOBS system and CBP’s Salesforce Contact Center Application. Applicants can login to the
new CBP portal, MyApplication.cbp.gov, by using their established USAJOBS login information
and can then view the status of their applications and communicate with the CBP Hiring Center in

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 52

order to obtain more information. Applicants will see all of their active applications with CBP and
can connect with their case workers by submitting questions electronically throughout the hiring
process. This new applicant portal replaced the CBP Jobs mobile application in September 2020.
After the individual logs in to the portal using their USAJOBS login information, the system
automatically matches their USAJOBS unique identifier to the HRBE and USA Staffing data
maintained in the Salesforce person account, if one already exists. If the individual has an active
application with CBP, the system will automatically match the USAJOBs ID to the Salesforce
person account and display their application data. Salesforce person accounts are also created by
CBP personnel during interactions with applicants, such as phone calls and emails and will not
include the USAJOBS unique identifier unless the individual has logged into the CBP portal. If
the individual doesn’t already have a Salesforce person account when they log into this new portal,
the Salesforce Contact Center Application will automatically create an account using data
integration received from HRBE and USA Staffing.
Salesforce Contact Center Application also allows candidates, applicants, and CBP the
ability to upload attachments and templates to cases. When a candidate or applicant emails an
attachment to CBP, the attachment automatically uploads to a case within Salesforce.
Salesforce Recruitment Application is a Salesforce Customer Relationship Manager
(CRM) tool that CBP HRM uses to support the recruiting process for all CBP positions. Candidates
interested in any CBP position can provide their contact information and career interests to CBP
at career fairs and other recruitment events or by registering online. Upon receiving the candidate’s
information, the Salesforce Recruitment Application shares limited PII, such as the name of the
individual and email address, and their subscriber status (subscribed/unsubscribed) with Adobe
Campaign, 52 which places the candidate in a targeted communication journey thanking the
candidate for signing up for the email distribution list and providing information on the position
of interest the candidate selected. Adobe Campaign will also provide applicant status e-mails to
individuals who have applied for a CBP position by providing notification of receipt, tentative
selection, polygraph queue, and medical process status during the application process.
An individual can opt-out of CBP’s information collection in both systems by not
submitting their information to CBP. Alternatively, if an individual signed up to join the CBP
Talent Network, the individual can submit a request to CBP to remove their information from the
Salesforce Recruitment Application by selecting the “opt-out” option in the email communication
and no further recruitment communication will be sent to the candidate. An applicant must receive
communication from CBP via Adobe Campaign in order to continue in the hiring process. If the
Adobe Campaign Cloud Software as a Service (Saas) provides email campaign, job offer, and personalization
management capabilities for sophisticated automation and execution of marketing programs across virtually all
channels – digital and traditional.

52

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 53

applicant does not want to receive this communication, they must withdraw their application with
CBP.
Using Mulesoft, an integration middle layer, HRBE and USA Staffing data for CBP
applicants is passed into the Recruitment Application. CBP recruiters are able to access the
Salesforce Recruitment Application and see the individual’s career interests and verify applicants’
status for each step of the hiring process, including whether the step within the hiring process has
been completed, review has been completed (or is pending), or the applicant passed or failed that
element. The use of the Salesforce Recruitment Application provides candidates, applicants, and
CBP the ability to upload attachments.
Salesforce Retirement and Benefits Application gives CBP employees the ability to
submit retirement and benefits-related questions and supporting documentation. Submitting this
information into a central repository allows HR staff to track decisions and provide prompt and
accurate responses and case status updates to employees. Submitted questions will be triaged and
responded to by HR specialists, who will have the option of involving additional HR staff with
expertise in the relevant functional areas. In the event that a CBP employee dies from an injury
sustained in the line of duty, CBP uses the Death Gratuity Information Sheet to collect information
from the next of kin or personal representative of the employee and the information is stored in
the Salesforce Retirement and Benefits Application. 53 In addition, metrics will be captured and
reported to allow HR management to focus resources on the areas with highest volume in order to
improve overall customer satisfaction.
Federal Emergency Management Agency (FEMA)
CareerConnector, the Department of Treasury’s automated staffing solution, allows
FEMA to hire individuals into Reservist positions. This system is used to create vacancy
announcements, review resumes and supporting documentation, and notify applicants of their
status.
U.S. Immigration and Customs Enforcement (ICE)
Electronic System for Personnel (ESP) is an automated web-based system used to
process ICE personnel actions pertaining to employment and payroll administrative functions.
During the initial recruitment stage, a personnel action is created in ESP for the vacancy and a
copy is sent to HITS. When the selectee has completed the hiring process and received an official
position offer from ICE, ICE hiring personnel enter the selectee’s information into ESP to close
the recruitment process. This is the only time that information about non-DHS employees is
For detailed information about the U.S. Office of Personnel Management (OPM) guidance and additional processes
related to the Death Gratuity Payment Authority, see OPM Memorandum Number 96-109, available at
https://www.opm.gov/retirement-services/publications-forms/benefits-administration-letters/1996/96-109.pdf.

53

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 54

entered into the system. Once the selectee enters on duty and becomes an employee, additional
information is included.
Hiring Information Tracking System (HITS) is used to track current and prior hiring
actions. It maintains information about individuals who are selected for vacant positions at ICE
and tracks them to the various stages of the hiring process. Once selected, ICE hiring personnel
manually enter the following selectee information in HITS. Additional information about the
selectee may be entered into the system depending on whether the selectee is currently an ICE
employee, holds an active security clearance, or if the position requires a higher level of fitness
proficiency than the one in which the selectee is certified.
Table of Organization Position System (TOPS) is part of the Office of the Chief
Financial Officer (OCFO) and maintains information about individuals who are employed by ICE
and the United States Citizenship and Immigration Services (USCIS), i.e., current and former
employees. TOPS provides OCFO with a means to (1) exercise control over position vacancies;
(2) maintain the agency’s Table of Organization; (3) track positions throughout their life cycle; (4)
link employees to positions; (5) support budgetary needs in determining and projecting costs of
positions; (6) reconstruct and display the work force as it existed at a given time in any particular
prior year; (7) provide the users a means of quickly and easily obtaining information; and (8)
provide program offices with the capability to efficiently create staff‐to-budget projections. TOPS
receives employee information, including name, Social Security number (SSN), and position
information from the U.S. Department of Agriculture (USDA) National Finance Center (NFC).
TOPS sends position information to the ICE Electronic System for Personnel (ESP) and the ICE
Hiring Information Tracking System (HITS). TOPS connects with HITS to support personnel and
hiring actions within ICE. When employee profiles are added or changed within HITS, HITS
executes a database data call to TOPS to retrieve and populate position data within HITS. TOPS
connects with ESP to verify the accuracy of position information in ESP. TOPS automatically
sends organization codes, position data, and titles to ESP, which enables ESP to process the U.S.
Office of Personnel Management’s (OPM) Standard Form-52, Request for Personnel Action.
Workforce Management (WM) Module within the Resource and Asset Management
System (RAMS) is an information management and analysis system used by the ICE Office of
Homeland Security Investigations (HSI) to coordinate and track all aspects of HSI recruitment and
hiring. WM collects, processes, and maintains information about: (1) applicants for ICE-HSI
positions; (2) newly hired employees and employees already onboard; (3) former employees of
ICE-HSI; (4) the dependents of employees of HSI-International who are serving on a foreign duty
station; and (5) foreign nationals who are locally hired by overseas ICE offices.
Transportation Security Administration (TSA)

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 55

Law Enforcement/Federal Air Marshal Service (LE/FAMS) Physical and Mental
Health Certification: LE/FAMS has established medical guidelines designed to ensure Federal
Air Marshals (FAMs) can safely and effectively perform the tasks essential to the arduous,
rigorous, and hazardous functions of the FAM position. The medical guidelines ensure a level of
health status and physical and psychological fitness for this public safety law enforcement position
that requires a high degree of responsibility. Medical examinations help determine a FAM
applicant and FAM incumbent’s medical status. FAM applicants are not asked any medical
questions until after they have received a conditional offer of employment. FAM applicants must
provide a completed TSA Form 1164, Mental Health Certification (MHC). Based on conditions
identified during the pre-employment or recurrent periodic examination, the applicant/employee
may be required to provide a completed and signed by his/her physician TSA Form 1133-3,
Practice Exercise Performance Requirements, or TSA Form 1163, Treating Physician Status
Report in order to determine if the FAM is medically qualified.
U.S. Citizenship and Immigration Services (USCIS)
Fast Acquisition of Superior Talent Hire (FASTHire) tracks and measures the length of
time each step in the hiring process takes, as well as the volume of hiring actions across USCIS.
The tool enables managers to track hiring timelines for each stage in the hiring process in relation
to OPM timeline goals. Data is entered into the FASTHire database by USCIS Human Resources
Operations Center staff during the hiring process.
Student Volunteer Employment Program (SVEP) provides students an opportunity to
gain work experience while in school. To qualify, each prospective intern must be a U.S. Citizen,
16 years of age, and enrolled in at least half-time academic or vocational and technical course load
in an accredited educational institution. Prospective interns’ email USCIS with their preferred
location(s) desired area(s) of interest, attach a copy of his/her resume as well as their school
transcripts to verify his/her enrollment as a student.
The USCIS Office of Human Capital and Training created a recruitment mailbox to support
offices who wish to hire non-paid interns under SVEP. The recruitment mailbox lists students by
location as well as area of interest, making it easy to identify prospective interns. If students are
contacted via email for a volunteer opportunity, the USCIS hiring manager guides the student
through the next steps that need to be taken, which includes sending in the proper paperwork to
the HR Specialist to onboard.
Human Resource End-to-End (HR-E2E) consists of two integrated, vendor-hosted
component applications:
•

Monster Hiring Management Enterprise (MHME) - a secure, comprehensive
talent acquisition system, purpose-built to automate and accelerate the federal

Privacy Impact Assessment
DHS/ALL/PIA-043(a) Talent Acquisition
Page 56

hiring process. Fully integrated with USAJOBS, HR Connect services,
Government HRIS systems and assessments, the system provides applicants and
hiring managers a simpler, easier, and faster way to navigate the federal
government’s hiring process.
•

UpTick (a Personnel Action Request system) - a connected software-as-a-service
system that will receive and store relevant workflow status updates, and when
needed – relevant job applicant information.

These applications collectively provide USCIS with applicant tracking, classification, and
onboarding automated services as well as other HR personnel services. The purpose of HR-E2E
is to provide specific USCIS HR and hiring managers the ability to create key documents and
manage processes relevant to classification, hiring and onboarding
United States Secret Service (USSS)
USSS Medical Program Use of FedHealth: The USSS Safety and Health Division
contracts with the U.S. Department of Health and Human Services (HHS), Federal Occupational
Health (FOH) to conduct employee and pre-employment medical examinations. FOH provides the
USSS Safety and Health Division access to the FOH scheduling, billing, and results modules in
FedHealth. USSS uses FedHealth to administer multiple medical examination program
requirements for all weapon-carrying positions within USSS. Both USSS employees and preemployment candidates appear for an appointment at an FOH facility and, prior to the examination,
sign a form authorizing FOH to release medical results to the USSS. The medical examination
results are then used to determine fitness for employment/duty.