Assessment Objective
Determine if:
- RA-08a. privacy impact assessments are conducted for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information;
- RA-08b.
- RA-08b.[01] privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that will be processed using information technology;
- RA-08b.[02] privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.
Assessment Methods
Examine
- Risk assessment policy
- security and privacy risk assessment reports
- acquisitions documents
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with assessment and auditing responsibilities
- system/network administrators
- system developers
- program managers
- legal counsel
- organizational personnel with security and privacy responsibilities
Test
- Organizational processes for assessments and audits
- mechanisms/tools supporting and/or implementing assessments and auditing
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | RA-08 Privacy Impact Assessments |