ICN as PII Risk Assessment

[parkerbees]

User story: As an Identity Team Product Owner, I would like to understand the risks associated with classifying an ICN as PII, and any potential courses of action to remediate that risk, so that I can thoroughly understand the risks and communicate them with OCTO leadership as appropriate.

Background: PO Tom Black asked Joe to assess the risks and recommendations associated with the proposed policy, announced here, that ICN should be treated as PII. Once complete, Tom will review the document and discuss it with Chris Johnston.

Additional Criteria: The documentation should strive for a minimum Flesch Reading Score of 70 for ease of understanding and scannability. Scoring can be done via MS365 Word (instructions). As with all output, the document should also strive for accessibility; if stored in Word, it should pass an accessibility check (instructions) with no errors.

Definition of Done:

• Risks are discussed amongst Identity team leadership and documented as a draft in any form
• The final document is transferred to VA Sharepoint, VA MS365, VA Github, or other official VA systems
• The final document is shared with Tom Black via official VA channels (OCTO Slack or VA email)
• All tests (below) have passed

Testing:

• The document is confirmed to be stored on VA systems
• The document contains an outline of risks
• The document contains recommendations for potential courses of action
• The document achieves a minimum Flesch Reading Score of 70
• The document, if stored in Word, passes an accessibility check with no errors.

Acceptance Criteria:

• All tasks and tests are complete

Additional Notes: a draft has already been created in Google Docs here.

[parkerbees]

Tagging myself so this gets moved to Jira