WP#4 - HCM Masking of PII Data
Purpose: This testing activity is part of Work Package #4 - HCM Masking. The following fields are being masked:
- Bank Account Number
- Date of Birth
- Driver's License Number
- Citizenship Proof
- National ID (NID)/Social Security Number (SSN)
- Passport Number
- Visa/Permit Number
To ensure masking is applied the ctcLink Security Support Team researched how to activate Oracle "delivered" masking for a number of the fields above. Where delivered masking did not apply the desired masking to a field, the Page & Field configurator was used. Use of these masking approaches prevents the viewing of highly sensitive data on those pages, unless a specific security role is granted enabling the viewing of this sensitive data. Testers are asked to verify the fields are masked using the existing security roles, then apply each of the two unmasking roles separately to verify that the data can be seen unmasked.
Audience: Local Security Administrators and HR Staff participating in User Acceptance Testing.
It is recommended during testing to first navigate and confirm the masking using a User Profile with no unmasking roles, then have an HR staff person test the same navigational paths with the unmask all role. Finally, have one or more HR staff test without the unmasking all role, but rather with the individual field masking role applied.
The following navigational paths will have Oracle delivered or applied (via Page & Field Configurator) masking turned on to mask PII data for all records:
Navigation: Main Menu>Benefits>Employee/Dependent Information>Update Dependent/Beneficiary
On the Update Dependent/Beneficiary component, on the Personal Profile tab, in the Personal Profile section, the Date of Birth field is masked for each of the employee's dependents/beneficiaries.
Also on the Personal Profile tab, in the National ID section the National ID field is masked, with only the last 4 digits of each of the employee's dependents/beneficiaries. The National Identification Number (NID) for US citizens equates to the Social Security Number (SSN).
To verify this field is masked, a tester must have one of the following security roles allowing them access the page while not allowing them to view the clear text data in the field without an unmasking security role:
- ZD Benefits Employee Data Inq
- ZZ Ben Admin
- ZC Benefits Enrollments
- ZC_BN_CORR_DEP_BENEF_DATA
- ZD_BN_VIEW_DEP_BENEF_DATA
- ZZ_BN_MAINT_DEP_BENEF_DATA
The Local Security Administrator would need to apply the ZZ HC Unmask National ID_SSN or ZZ HC Unmask DOB security role to unmask the specific fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Payroll for North America>Employee Pay Data USA>Request Direct Deposit
On the Request Direct Deposit page, in the Distribution section the Account Number field is masked, with only the last 4 digits of the account number visible.
To verify this field is masked, a tester must have one of the following security roles allowing them access the page while not allowing them to view the clear text data in the field without an unmasking security role:
- ZC Payroll Data Maintenance
- ZD Payroll Data Maintenance
- ZZ Payroll Data Maintenance
- ZZ Payroll Processing
- ZZ SS Payroll
- ZC_PY_CORR_EE_PAY_DATA
The Local Security Administrator would need to apply the ZZ HC Unmask Bank Acct security role to unmask the specific bank account field. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Workforce Administration>Personal Information>Biographical>Driver's License Data
On the Driver's License Data page, in the Driver's License Information section the Driver's License Nbr field is masked, with only the last 4 digits of the number visible.
To verify this field is masked, a tester must have one of the following security roles allowing them access the page while not allowing them to view the clear text data in the field without an unmasking security role:
- ZC HR Employee Maintenance
- ZZ HR Employee Maintenance
- ZZ SS Workforce Administrator
The Local Security Administrator would need to apply the ZZ HC Unmask Drivers License security role to unmask the specific Driver's License Nbr field. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Workforce Administration>Personal Information>Biographical>Update Person Detail
On the Update Person Detail page, on the Biographical Details tab, in the Biographic Information section the Date of Birth field is masked.
On the Biographical Details tab, in the National ID section the National ID field is masked, with only the last 4 digits of the employee's Social Security Number displayed. The National Identification Number (NID) for US citizens equates to the Social Security Number (SSN).
To verify this field is masked, a tester must have one of the following security roles allowing them access the page while not allowing them to view the clear text data in the field without an unmasking security role:
- ZC HR Employee Maintenance
- ZD HCM SOGI
- ZZ HR Employee Maintenance
- ZZ SS Workforce Administrator
The Local Security Administrator would need to apply the ZZ HC Unmask National ID_SSN or the ZZ HC Unmask DOB security role to unmask the specific fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Workforce Administration>Personal Information>Citizenship>Citizenship, Visa and Permits
On the Citizenship/Passport tab, in the Citizenship/Passport section the Passport Number field is masked, with no digits of the employee's passport number displayed:
On the Visa/Permit Data tab, in the Visa/Permit History section the Number field is masked, with no digits of the employee's visa permit number displayed:
To verify these fields are masked, a tester must have one of the following security roles allowing them access the page while not allowing them to view the clear text data in the fields without an unmasking security role:
- ZC HR Employee Maintenance
- ZD HR Central Config VW
- ZD HR Employee Maintenance VW
- ZD HR Inquiry
- ZZ HR Employee Maintenance
- ZZ SS Workforce Administrator
The Local Security Administrator would need to apply the ZZ HC Unmask Passport security role to unmask the specific passport or visa/permit field. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Workforce Administration>Personal Information>Modify a Person
On the Modify a Person page, on the Biographic Details tab, in the Biographic Information section, the Date of Birth field is masked.
Also on the Biographic Details tab, in the National ID section the National ID field is masked, with only the last 4 digits of the employee's SSN displayed. The National Identification Number (NID) for US citizens equates to the Social Security Number (SSN).
To verify the fields are masked, a tester must have one of the following security roles allowing them access the page while not allowing them to view the clear text data in the field without an unmasking security role:
- ZC HR Employee Maintenance
- ZZ HR Employee Maintenance
- ZZ SS Workforce Administrator
- ZD HR Inquiry
- ZD HR Central Config VW
- ZD HCM SOGI (this role does not display the regional tab)
- ZD HR Limited Person Job Info (this role does not display the regional tab)
The Local Security Administrator would need to apply the ZZ HC Unmask National ID_SSN or the ZZ HC Unmask DOB security role to unmask the specific fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
On the Regional tab, in the History section the Citizenship (Proof 1) and Citizenship (Proof 2) fields are masked. This field can contain information such as green card or other open text words that would reveal an employee's immigration status.
To verify the Citizenship Proof fields are masked, a tester must have one of the following security roles allowing them access the page while not allowing them to view the clear text data in the fields without an unmasking security role:
- ZC HR Employee Maintenance
- ZZ HR Employee Maintenance
- ZZ SS Workforce Administrator
- ZD HR Inquiry
- ZD HR Central Config VW
The Local Security Administrator would need to apply the ZZ HC Unmask Passport security role to unmask the passport, visa/permit and citizenship proof fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Workforce Administration>Personal Information>Personal Relationships>Dependent Identification
While this page has been included in HCM masking delivered masking set, it is unlikely that colleges will have data on this page as it is not a standard business practice to collect the passport and/or visa permit data for dependents.
On the Dependent Identification page, on the Depdnt Citizenship/Passport tab, in the Passport Details section the Passport Number field is masked, where no digits of the passport number of the dependent of the employee are displayed:
On the Depdnt Visa/Permit Data tab, in the Visa/Permit History section the Number field is masked, where no digits of the visa permit number belonging to the dependent of the employee are displayed:
To verify the Passport Number and Visa/Permit Number fields are masked, a tester must have one of the following security roles allowing them access the page while not allowing them to view the clear text data in the fields without an unmasking security role:
- ZC HR Employee Maintenance
- ZD HR Central Config VW
- ZD HR Employee Maintenance VW
- ZD HR Inquiry
- ZZ HR Employee Maintenance
The Local Security Administrator would need to apply the ZZ HC Unmask Passport security role to unmask the specific passport and visa/permit fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Workforce Administration>Personal Information>Personal Relationships>Dependent Information
On the Dependent Information page, on the Person Profile tab, in the Person Profile section the Date of Birth field is masked.
Also, in the National ID section, the National ID field is masked, with only the last 4 digits of the employee's Social Security Number displayed. The National Identification Number (NID) for US citizens equates to the Social Security Number (SSN).
To verify the Date or Birth and National ID Number fields are masked, a tester must have one of the following security roles allowing them access the page while not allowing them to view the clear text data in the fields without an unmasking security role:
- ZC HR Employee Maintenance
- ZD HR Central Config VW
- ZD HR Employee Maintenance VW
- ZD HR Inquiry
- ZZ HR Employee Maintenance
The Local Security Administrator would need to apply the ZZ HC Unmask National ID_SSN or the ZZ HC Unmask DOB security role to unmask the specific fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Workforce Administration>Personal Information>Biographical>Update Person Detail
On the Employee HR and Payroll Data page, in the National ID section the National ID field is masked, with only the last 4 digits of the employee's Social Security Number displayed. The National Identification Number (NID) for US citizens equates to the Social Security Number (SSN).
Also, in the Significant Dates section, the employee's Date of Birth is masked with the month and day visible, but the year masked.
To verify the National ID (NID) and Date of Birth fields are masked, a tester must have one of the following security roles allowing them access the page while not allowing them to view the clear text data in the fields without an unmasking security role:
- ZD Benefits Employee Data Inq
- ZZ Ben Admin
The Local Security Administrator would need to apply the ZZ HC Unmask SSN or the ZZ HC Unmask DOB security role to unmask the specific fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
0 Comments
Add your comment