Version 1.2

 

Interim guidance for the use of Forms
on IMCOM Enterprise Web

 

References:

1. SCOPE

This guidance covers all forms on IEW, as defined in DA Pam 25-40, Chapter 12-3

12–3. What is a form?
a. A form is a fixed arrangement of captioned spaces designed for gathering, organizing, and transmitting prescribed information quickly and efficiently. It also serves as a historical record. A form may be in hardcopy, stand-alone electronic file, electronic system of Web based screen(s), or other media. Certificates are forms. Items such as labels, stickers, tags, instruction sheets, notices, and file covers do not require insertion of information; however, they may still be considered forms for procurement purposes.

 Both Web forms (those filled in directly on the page) and downloadable/fillable forms (such as .pdfs or Word documents for users to fill out and send in) are covered here.

2. ORDER OF PREFERENCE:

Follow this order of preference when choosing what kind of form to use:

a. When they become available: Use one of the preauthorized web forms available from IMCOM Headquarters

b. Use a suitable, existing SF, OF, DA, DD, AMC or IMCOM form.  If necessary, partially fill in the form (overprint) and upload it to your site to be downloaded, filled-in, and returned via email.

c. Produce an authorized local downloadable form.

d. Produce a custom web-based fillable form.

3. ALL FORMS

All forms must be approved by the Forms Mangement Officer  (FMO) appropriate to the organization and level. A form issued by the senior command should be signed off by the command's form manager. A copy of the approval should be forwarded to the IEW CMS manager (currently Neal Snyder). The garrison form manager is typically also in charge of privacy, Freedom of Information Act, and document management. As such, they can provide valuable assistance as you build your forms.

All forms must be prescribed by a regulatory document at the appropriate level. The regulation needs to mention the form by name/number and offer instructions on its use.

If it's a local form, find a garrison or senior command regulation calling for the use of the form. Office forms should be guided by an SOP or memorandum. When you work with your forms manager, they may be able to affect local regulations or policy to allow you to use the form.

All forms must include a a privacy act statement or privacy advisory (DoDI 8170.01, DoDI 7750.07). They must be numbered and cataloged.

4. PREAUTHORIZED WEB FORMS

We are in the process of producing forms available as blocks that  can be dragged and dropped into your site. None are available yet. Once they are complete, you will be able to add them without any additional paperwork. We do have authorization to build the following:

Service work order:

Contact Us:

5. EXISTING AGENCY FORMS

All requirements are met by the publishing agency -- you don't have to go through the authorization process. We will help you pick out, overprint (if necessary) and upload your forms.

a. Check for a suitable existing GSA Standard Form (SF), GSA Optional Form (OF), Department of the Army (DA) Form, Department of Defense (DD) form, or IMCOM form (this will be the easiest route), in that order (see the hierarchy on p. 141-142 of DA Pam 25-40). Links to the forms sites are available in the right column.

--If the form works as-is, consider linking directly to the form on the site, in case of later updates.

--If you need to partially fill in or customize the form (such as adding a button to send the form by email, you can host it as a downloadable file on IEW.

--DO NOT upload completed forms (that is, containing PII) to IEW.  Instead, set it up to be submitted throuogh Adobe Acrobat to your email address.

6. INSTALLATION, LOCAL AND OFFICE FORMS

If an existing form doesn't fulfill the need, you can work with your FMO to produce a new form.  There are two kinds (DA PAM 25-40):

g. Installation and local forms. These forms are prescribed for use only within a particular headquarters, such as an installation or activity headquarters and are prescribed by an installation regulatory publication for use within the installation. Examples are “Fort Lee Form 1234” and “Redstone Arsenal Form 1234.” ...
h. Office forms. If a form is used by only one organizational element, such as an office, a prescribing publication is not required; however, appropriate written guidance is recommended (for example, an SOP or office memorandum).

An office form needs to follow the same Privacy Act and numbering rules as installation or DA forms. For instance, your local model release might need to be named "Fort Notional PAO Form 3" and include a Privacy Act Statement.

Of course there is a form for this process: DD Form 67*.  Use it.

Seeking form approval  is not automatically the job of PAO, garrison G6 or the NEC. The office with an interest in posting the form should take the lead.

The office requiring the form must work with the forms manager appropriate to their chain of command (garrison offices work with the garrison forms manager) to ensure regulatory compliance (we'll need a note of approval). They will probably simply take the document you use already and put a form number and privacy statement on it. The advantage here is once you work it out, you can collect different PII than IEW will allow you to.  If required, the forms manager will work with the requesting office to set up the required privacy controls.

7. CUSTOM WEB FORMS

Web forms are still an option. They must be built here in Texas and , be changed here at headquarters and be approved by the CMS manager (me), AND YOUR LOCAL Privacy office and the Cybersecurity cell. We have locked down editing for web forms we've been able to find and disabled all forms creation tools. I am also working on Privacy Act Statements or Privacy Advisories for those forms that need them.

Almost all of the rules regarding downloadable forms apply to web-native forms.

8. 'CONTACT US'

"Forms" asking for name, email or phone and a message are simple contact instruments. Their purpose is not to organize or store information. Based on a survey of practices across Army and DoD websites, including defense.gov, ARCYBER and HQDA do not use a Privacy Act Statement (PAS) with this kind of instrument. Many do include Privacy Advisories (per DODI 8170.01 3.27). An example is the contact form at the bottom of https://www.defense.gov/Ask-Us/. 

RULES:

  • All fields must be optional.
  • Do not ask for specific information
  • Include a link to the Terms of Service page labeled "Privacy Advisory" as close as possible to the form (our privacy advisory is included in our TOS).

 

9. NONCONFORMING FORMS

Please identify all unauthorized forms to the CMS Manager as soon as possible. Include location and a timeline for bringing the form into compliance. Any unauthorized forms found without a plan of action for conforming to this standard will be removed or quarrantined without announcement.

 

Again, this is the temporary guidance. Stay tuned.

*DD Form 67 does not have a Privacy Act Statement.