ATTACHMENT 12_ Privacy Officer SORNS Email Exchange

From:
To:
Cc:
Subject:
Date:

Bjorkman, Michael - FNS, Alexandria, VA
Mengesha, Isabelle - FNS; Mountjoy, Candy - FNS
Robertson, Loretta - FNS; Stewart, Kelly - FNS
RE: SORNS for FPRS, ICR 0584-0594 Question
Tuesday, April 26, 2022 10:54:48 AM

Hi Isabelle,

Correct.

Yes, I believe this email exchange is what PRAO is looking for.

V/r,
Michael Bjorkman
Privacy Officer
USDA Food and Nutrition Service
Information Management Branch (IMB)
[email protected]

To report a PII or cyberincident please contact our 24-Hour ISC Incident Hotline at 1 (866) 905-6890
[email protected], or the PII Hotline at: 1-877-PII 2YOU [1-877-744-2968].

From: Mengesha, Isabelle - FNS
Sent: Tuesday, April 26, 2022 10:50 AM
To: Bjorkman, Michael - FNS, Alexandria, VA ; Mountjoy, Candy - FNS

Cc: Robertson, Loretta - FNS ; Stewart, Kelly - FNS

Subject: RE: SORNS for FPRS, ICR 0584-0594 Question

Hi Michael,

Thank you for the clarification! A SORN for FPRS is not required, but a SORN for e-Auth does exist
and can be an attachment.

One more question, in the comments from PRAO, it also mentioned e-Auth, “storage, linkable; verify
with email sent.”

Do you happen to know if this email exchange is the email PRAO is looking for?

Thanks,
Isabelle

From: Bjorkman, Michael - FNS, Alexandria, VA
Sent: Tuesday, April 26, 2022 10:43 AM
To: Mengesha, Isabelle - FNS ; Mountjoy, Candy - FNS

Cc: Robertson, Loretta - FNS ; Stewart, Kelly - FNS

Subject: RE: SORNS for FPRS, ICR 0584-0594 Question

Hi Isabelle,

I don’t think any SORN language should be removed. I am saying that it is still accurate that a SORN is
not required for FPRS. Just a slight edit to the already existing language found in the third sentence
of A10.

Regarding the e-Auth SORN as an attachment, if PRAO requests that this be an attachment then I
don’t have an issue with it.

Thanks!

V/r,
Michael Bjorkman
Privacy Officer
USDA Food and Nutrition Service
Information Management Branch (IMB)
[email protected]

To report a PII or cyberincident please contact our 24-Hour ISC Incident Hotline at 1 (866) 905-6890
[email protected], or the PII Hotline at: 1-877-PII 2YOU [1-877-744-2968].

From: Mengesha, Isabelle - FNS
Sent: Tuesday, April 26, 2022 10:32 AM
To: Bjorkman, Michael - FNS, Alexandria, VA ; Mountjoy, Candy - FNS

Cc: Robertson, Loretta - FNS ; Stewart, Kelly - FNS

Subject: RE: SORNS for FPRS, ICR 0584-0594 Question

Hi Michael,

Thank you! I will remove the language that SORN is not necessary and add the sentence in your
email below. Will the OCIO e-Auth SORN now need to be an attachment to the supporting
statement?

Thanks,
Isabelle

From: Bjorkman, Michael - FNS, Alexandria, VA
Sent: Tuesday, April 26, 2022 10:29 AM

To: Mengesha, Isabelle - FNS ; Mountjoy, Candy - FNS

Cc: Robertson, Loretta - FNS ; Stewart, Kelly - FNS

Subject: RE: SORNS for FPRS, ICR 0584-0594 Question

Thanks Candy and Isabelle.

We should be able to satisfy PRAO’s comments by including a reference to the e-Auth SORN. I
believe everything else can stay the same – FPRS does not collect personally identifiable information
(PII) or Privacy Act records and therefore a SORN is not required for the system itself. Since we
mention e-Auth and that FPRS utilizes e-Auth, we can include a reference to the OCIO e-Auth SORN. I
believe the below edits to language already included in A10 should suffice:

“Users are authenticated using USDA e-Authentication, which is covered by the USDA/OCIO-2
eAuthentication Service SORN.”

Please let me know if you have any questions.

V/r,
Michael Bjorkman
Privacy Officer
USDA Food and Nutrition Service
Information Management Branch (IMB)
[email protected]

To report a PII or cyberincident please contact our 24-Hour ISC Incident Hotline at 1 (866) 905-6890
[email protected], or the PII Hotline at: 1-877-PII 2YOU [1-877-744-2968].

From: Mengesha, Isabelle - FNS
Sent: Monday, April 25, 2022 2:17 PM
To: Mountjoy, Candy - FNS ; Bjorkman, Michael - FNS, Alexandria, VA

Cc: Robertson, Loretta - FNS ; Stewart, Kelly - FNS

Subject: RE: SORNS for FPRS, ICR 0584-0594 Question

Hi all,

Thanks for the quick replies. Attached is the Supporting Statement that we are currently working on,
as well as the Supporting Statement that Candy sent, so they are both in one place. The comments
about SORNS are highlighted, one in the Table of contents and one on page 13.

Thank you both!
Isabelle

From: Mountjoy, Candy - FNS
Sent: Monday, April 25, 2022 2:14 PM
To: Bjorkman, Michael - FNS, Alexandria, VA ; Mengesha, Isabelle FNS
Cc: Robertson, Loretta - FNS ; Stewart, Kelly - FNS

Subject: RE: SORNS for FPRS, ICR 0584-0594 Question

I just realized that the attachment I was looking for was the privacy assessment that Isabelle
attached earlier.

From: Mountjoy, Candy - FNS
Sent: Monday, April 25, 2022 2:13 PM
To: Bjorkman, Michael - FNS, Alexandria, VA ; Mengesha, Isabelle FNS
Cc: Robertson, Loretta - FNS ; Stewart, Kelly - FNS

Subject: RE: SORNS for FPRS, ICR 0584-0594 Question

Good afternoon.

I’m attaching the supporting statement from 2019. In question 10, it references an attachment
which I am looking for now.

Thanks,
Candy

From: Bjorkman, Michael - FNS, Alexandria, VA
Sent: Monday, April 25, 2022 1:41 PM
To: Mengesha, Isabelle - FNS ; Mountjoy, Candy - FNS

Cc: Robertson, Loretta - FNS ; Stewart, Kelly - FNS

Subject: RE: SORNS for FPRS, ICR 0584-0594 Question

Good afternoon,

Would you be able to provide a copy of the supporting statement with PRAO’s comments? Also,
could you provide a copy of the 2019 supporting statement so I can compare?

Thanks!

V/r,

Michael Bjorkman
Privacy Officer
USDA Food and Nutrition Service
Information Management Branch (IMB)
[email protected]

To report a PII or cyberincident please contact our 24-Hour ISC Incident Hotline at 1 (866) 905-6890
[email protected], or the PII Hotline at: 1-877-PII 2YOU [1-877-744-2968].

From: Mengesha, Isabelle - FNS
Sent: Monday, April 25, 2022 12:18 PM
To: Bjorkman, Michael - FNS, Alexandria, VA ; Mountjoy, Candy - FNS

Cc: Robertson, Loretta - FNS ; Stewart, Kelly - FNS

Subject: SORNS for FPRS, ICR 0584-0594 Question

Hi Michael and Candy,

I hope you are doing well! I just received the passback for the ICR package for FPRS (OMB# 05840594).

One of PRAO’s comments was that although the Privacy Officer did sign off on the package, there
was no language in question A10 about the SORNS for USDA e-auth. PRAO also provided the
attached SORNS related to FPRS (e-Auth SORN pub March2012).

Looking back at the previously approved ICR package completed by FM in 2019, there is language in
A10 that a SORN is not needed and references the attached Privacy Impact Assessment.

Could either of you clarify what the correct response is in regard to the USDA e-Auth SORMS for
FPRS?

Thank you!

Isabelle Mengesha
She/her/hers
SNAP Office of Employment and Training
USDA-FNS