1. SPIA Web Application
Introduction

2. Privacy Impact Assessment What is SPIA? Security and
Annual risk assessment program conducted at School/Center level to identify privacy and security risks in databases and applications

3. Why SPIA is Important?
Helps ensure information entrusted to Penn is properly protected
Need to understand:
What data Penn has on its systems
What risks exist in our environment
How those risks can be reduced or even eliminated
Trustees recognize the need to create data inventories in order to assess risks to Penn data

4. SPIA 2.0 – Goals Simplify the SPIA program
Create one tool for inventory
and risk assessment
Provide ability to view data inventories
Make risk assessment simpler, more flexible
Raise awareness of controls/safeguards
Make updates easier year-to-year
Areas for improvement with the program

5. SPIA Web Application
Automated assessments - no more spreadsheets/ s
Role-based access controls allow for delegation of inventory creation
Flexible approach to assessing controls and risk
Populates selected information into an Executive Summary
Data rolled over annually for easier updates
Data will be stored in database to enable reporting

6. Administration “Asset” represents the item being assessed.
“Inventory” represents a collection of related assets.
“Departments/Units” represent subgroups within a School/Center created for the purpose of organizing data inventories.

7. Roles & Responsibilities
Inventory Managers
Create and edit inventories and assets within their Unit
Multiple users available at this level
View only those inventories and assets within their Department/Unit
Assess/review all Department/Unit level assets for inclusion in an Executive Summary
School/Center Administrator
All of the above plus…
Create Departments/Units
Assign Inventory Managers
Create an Executive Summary
Push an Executive Summary and Final Inventory to InfoSec/Privacy
A snapshot of the “Final” inventory will be taken annually at the time the School/Center submits it to InfoSec/Privacy.  

8. Roles & Responsibilities
InfoSec/Privacy
Manage controls list
Manage School/Center Administrators
View all School/Center Inventories/Executive Summaries
Provide Responses to Submissions
Create Reports

9. Organizational Structure

10. Process Submit Inventories and Executive Summary to InfoSec/Privacy
Create and Assess Inventories of Assets
Create Executive Summary
Submit Inventories and Executive Summary to InfoSec/Privacy

11. Questions