Enterprise User Administration

The information that may be collected and stored is the following: name; business address, telephone number, email and company name; Social Security number; password; CMS user ID; organizational affiliation, contract information (if applicable); and assigned job codes for authorized access to CMS systems.  

This system also contains internal administration information, such as assigned job codes, system access history, workflows, and approvals necessary to grant various types of access. To log into the EUA system, every user must input their user ID and password or PIV. External users also must enter a second factor, such as one-time PIN via text message or email. 

The EUA system manages access to other CMS information systems and applications. EUA allows each user to manage their account information and request job codes for access to other CMS information systems and applications. EUA users are CMS employees and direct contractors primarily. In addition, for access to certain other CMS systems, there are other authorized users from states, tribal/local agencies, other HHS departments and other Federal agencies. Requests for job codes are approved by authorized CMS Access Administrators (CAA). The EUA system also track the Computer Based Training (CBT) certification process that must be completed annually to retain access to other CMS systems.

EUA uses PII to retrieve system records, including the CMS user ID, password, email address and a password hint. This allows an authorized EUA user (described above) to access the system. 

The information collected and stored in EUA is used to identify/authenticate the users. The information collected includes a user's name, SSN, business address, telephone number, email address, business mailing address, employment status, date of birth, company name, CMS user ID and passwords, and organizational affiliation.

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Date of Birth
• Mailing Address
• Employment Status
• Other - Company name and address, CMS user ID and password, Federal Agency affiliation, contract information, job codes, and internal administration information.

• Employees
• Business Partners/Contacts (Federal, state, local agencies)

• Online

• Within the OPDIV
• Other HHS OPDIV
• State/Local/Tribal
• Other Federal Entities

• Within HHS: PII is used to uniquely identify CMS information system users.

Administrators: Database administrators, system administrators and CAAs, who are either CMS employees or direct contractors, will have various access levels to PII to perform system functions or manage other EUA user accounts. 

Developers: Developers may have access to PII for database migration and reporting activities. This access window will be time-controlled and monitored to ensure data integrity.

Others - CMS IT help desk staff: While not administrators, the CMS IT help desk staff has minimal access to PII in order to reset accounts when a user locks themselves out.

The CMS Information Security and Privacy Awareness Training is required to be completed by all users on an annual basis. This training is mandatory for continued access to CMS systems.

In addition, the direct contractor organizations require their staff to take company-sponsored annual security and privacy training. In both scenarios, users acknowledge successful training after passing a test at the end of training and the system verifies completion. 

EUA follows the CMS Records Control Schedules located on the CMS website and the National Archives and Records Administration (NARA) website. 

For CMS and the information systems that support its missions, the NARA Transmittal 29 includes the General Records Schedules (GRS) that are followed. GRS 3.2 provides the requirements for the retention and destruction of PII handled by EUA. For System Access Records (GRS 3.2 Item 030), EUA retains records for up to six (6) years to enable the recreation of computer related accesses to both the operation system and the application wherever PII is stored. 

EUA follows the guidance of National Institute of Standards and Technology (NIST) Special Publication 800-88 Rev. 1 as part of the implementation of the Media Protection Security controls. EUA will disintegrate, pulverize, melt, incinerate, and/or shred PII data once it is no longer necessary to retain. Certificates of destruction are completed and retained whenever PII data is destroyed.

Administrative Controls: The administrative controls in place to secure the PII include role-based access and permissions, periodic review of users and deletion or revoking of user accounts. Only authorized administrators can approve job code requests and there is a multi-tier process to authorize access. 

Technical Controls: The technical controls in place are firewalls that prevent unauthorized access, encrypted access at log on, security scans, penetration testing, and intrusion detection and prevention systems (IDS/IPS) and computer system controls that prevent users without administrative or developer access too long into a test environment and the test environment and usable application are not joined together. 

Physical Controls: EUA is hosted in a secure data center that employs physical controls and monitoring to restrict physical access and ensure the security of doors with the use of security cards and pass codes; environmental controls that ensure the efficacy of heating, ventilation and air conditioning; smoke and fire alarms, and fire suppression systems; and by employing cameras, fencing and security guards.