Develop, document, and fully implement a formal process to identify, track, and periodically update all personally identifiable information collected, processed and stored throughout the Bureau. At a minimum this inventory should clearly identify what personally identifiable information the Bureau is collecting or handling, who within the Bureau is responsible for the security of the personally identifiable information, where the personally identifiable information is stored (both physical and logical), and whether a privacy impact assessment or system of records notice is required.