Assessment Objective

Determine if:

• PT-06(02)[01] all Privacy Act exemptions claimed for the system of records are reviewed [Assignment: frequency] to ensure that they remain appropriate and necessary in accordance with law;
• PT-06(02)[02] all Privacy Act exemptions claimed for the system of records are reviewed [Assignment: frequency] to ensure that they have been promulgated as regulations;
• PT-06(02)[03] all Privacy Act exemptions claimed for the system of records are reviewed [Assignment: frequency] to ensure that they are accurately described in the system of records notice.

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• privacy notice
• Privacy Act system of records
• Privacy Act exemptions
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for Privacy Act system of records maintenance

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final