Assessment Objective

Determine if:

• PM-27a. [Assignment: privacy reports] are developed;
  • PM-27a.01 the privacy reports are disseminated to [Assignment: oversight bodies] to demonstrate accountability with statutory, regulatory, and policy privacy mandates;
  • PM-27a.02
    • PM-27a.02[01] the privacy reports are disseminated to [Assignment: officials];
    • PM-27a.02[02] the privacy reports are disseminated to other personnel responsible for monitoring privacy program compliance;
• PM-27b. the privacy reports are reviewed and updated [Assignment: frequency].

Assessment Methods

Examine

• Privacy program plan
• internal and external privacy reports
• privacy program plan
• annual senior agency official for privacy reports to OMB
• reports to Congress required by law, regulation, or policy, including internal policies
• records documenting the dissemination of reports to oversight bodies and officials responsible for monitoring privacy program compliance
• records of review and updates of privacy reports.

Interview

• Organizational personnel with privacy program responsibilities
• organizational personnel with privacy responsibilities
• legal counsel.

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final