Assessment Objective
Determine if:
- PM-26[01] a process for receiving complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;
- PM-26[02] a process for responding to complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;
- PM-26a.
- PM-26a.[01] the complaint management process includes mechanisms that are easy to use by the public;
- PM-26a.[02] the complaint management process includes mechanisms that are readily accessible by the public;
- PM-26b. the complaint management process includes all information necessary for successfully filing complaints;
- PM-26c.
- PM-26c.[01] the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within [Assignment: time period];
- PM-26c.[02] the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within [Assignment: time period];
- PM-26d. the complaint management process includes acknowledging the receipt of complaints, concerns, or questions from individuals within [Assignment: time period];
- PM-26e. the complaint management process includes responding to complaints, concerns, or questions from individuals within [Assignment: time period].
Assessment Methods
Examine
- Privacy program plan
- procedures addressing complaint management
- complaint documentation
- procedures addressing the reviews of complaints
- other relevant documents or records
Interview
- Organizational personnel with privacy program responsibilities
- organizational personnel with privacy responsibilities
Test
- Organizational processes for complaint management
- mechanisms supporting complaint management
- tools used by the public to submit complaints, concerns, and questions (e.g., telephone, hotline, email, or web-based forms
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | PM-26 [P] Complaint Management |