Assessment Objective
Determine if:
- PM-18a.
- PM-18a.[01] an organization-wide privacy program plan that provides an overview of the agency’s privacy program is developed;
- PM-18a.01
- PM-18a.01[01] the privacy program plan includes a description of the structure of the privacy program;
- PM-18a.01[02] the privacy program plan includes a description of the resources dedicated to the privacy program;
- PM-18a.02
- PM-18a.02[01] the privacy program plan provides an overview of the requirements for the privacy program;
- PM-18a.02[02] the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program;
- PM-18a.02[03] the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program;
- PM-18a.03
- PM-18a.03[01] the privacy program plan includes the role of the senior agency official for privacy;
- PM-18a.03[02] the privacy program plan includes the identification and assignment of the roles of other privacy officials and staff and their responsibilities;
- PM-18a.04
- PM-18a.04[01] the privacy program plan describes management commitment;
- PM-18a.04[02] the privacy program plan describes compliance;
- PM-18a.04[03] the privacy program plan describes the strategic goals and objectives of the privacy program;
- PM-18a.05 the privacy program plan reflects coordination among organizational entities responsible for the different aspects of privacy;
- PM-18a.06 the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by organizational operations (including, mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
- PM-18a.[02] the privacy program plan is disseminated;
- PM-18b.
- PM-18b.[01] the privacy program plan is updated [Assignment: frequency];
- PM-18b.[02] the privacy program plan is updated to address changes in federal privacy laws and policies;
- PM-18b.[03] the privacy program plan is updated to address organizational changes;
- PM-18b.[04] the privacy program plan is updated to address problems identified during plan implementation or privacy control assessments.
Assessment Methods
Examine
- Privacy program plan
- procedures addressing program plan development and implementation
- procedures addressing program plan reviews, updates, and approvals
- procedures addressing coordination of the program plan with relevant entities
- records of program plan reviews, updates, and approvals
- other relevant documents or records
Interview
- Organizational personnel with privacy program planning and plan implementation responsibilities
- organizational personnel with privacy responsibilities
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | PM-18 [P] Privacy Program Plan |