Assessment Objective

Determine if:

• PT-06a.
  • PT-06a.[01] system of records notices are drafted in accordance with OMB guidance for systems that process information that will be maintained in a Privacy Act system of records;
  • PT-06a.[02] new and significantly modified system of records notices are submitted to the OMB and appropriate congressional committees for advance review for systems that process information that will be maintained in a Privacy Act system of records;
• PT-06b. system of records notices are published in the Federal Register for systems that process information that will be maintained in a Privacy Act system of records;
• PT-06c. system of records notices are kept accurate, up-to-date, and scoped in accordance with policy for systems that process information that will be maintained in a Privacy Act system of records.

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• privacy notice
• Privacy Act system of records
• Federal Register notices
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for Privacy Act system of records maintenance

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final