Assessment Objective
Determine if:
- PT-01a.
- PT-01a.[01] a personally identifiable information processing and transparency policy is developed and documented;
- PT-01a.[02] the personally identifiable information processing and transparency policy is disseminated to [Assignment: personnel or roles];
- PT-01a.[03] personally identifiable information processing and transparency procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and associated personally identifiable information processing and transparency controls are developed and documented;
- PT-01a.[04] the personally identifiable information processing and transparency procedures are disseminated to [Assignment: personnel or roles];
- PT-01a.01
- PT-01a.01(a)
- PT-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses purpose;
- PT-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses scope;
- PT-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses roles;
- PT-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses responsibilities;
- PT-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses management commitment;
- PT-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses coordination among organizational entities;
- PT-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses compliance;
- PT-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
- PT-01a.01(a)
- PT-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures;
- PT-01c.
- PT-01c.01
- PT-01c.01[01] the current personally identifiable information processing and transparency policy is reviewed and updated [Assignment: frequency];
- PT-01c.01[02] the current personally identifiable information processing and transparency policy is reviewed and updated following [Assignment: events];
- PT-01c.02
- PT-01c.02[01] the current personally identifiable information processing and transparency procedures are reviewed and updated [Assignment: frequency];
- PT-01c.02[02] the current personally identifiable information processing and transparency procedures are reviewed and updated following [Assignment: events].
- PT-01c.01
Assessment Methods
Examine
- Personally identifiable information processing and transparency policy and procedures
- privacy plan
- privacy program plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with information security and privacy responsibilities
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | PT-01 [P] Policy and Procedures |