Assessment Objective

Determine if:

• PM-18a.
  • PM-18a.[01] an organization-wide privacy program plan that provides an overview of the agency’s privacy program is developed;
  • PM-18a.01
    • PM-18a.01[01] the privacy program plan includes a description of the structure of the privacy program;
    • PM-18a.01[02] the privacy program plan includes a description of the resources dedicated to the privacy program;
  • PM-18a.02
    • PM-18a.02[01] the privacy program plan provides an overview of the requirements for the privacy program;
    • PM-18a.02[02] the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program;
    • PM-18a.02[03] the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program;
  • PM-18a.03
    • PM-18a.03[01] the privacy program plan includes the role of the senior agency official for privacy;
    • PM-18a.03[02] the privacy program plan includes the identification and assignment of the roles of other privacy officials and staff and their responsibilities;
  • PM-18a.04
    • PM-18a.04[01] the privacy program plan describes management commitment;
    • PM-18a.04[02] the privacy program plan describes compliance;
    • PM-18a.04[03] the privacy program plan describes the strategic goals and objectives of the privacy program;
  • PM-18a.05 the privacy program plan reflects coordination among organizational entities responsible for the different aspects of privacy;
  • PM-18a.06 the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by organizational operations (including, mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
  • PM-18a.[02] the privacy program plan is disseminated;
• PM-18b.
  • PM-18b.[01] the privacy program plan is updated [Assignment: frequency];
  • PM-18b.[02] the privacy program plan is updated to address changes in federal privacy laws and policies;
  • PM-18b.[03] the privacy program plan is updated to address organizational changes;
  • PM-18b.[04] the privacy program plan is updated to address problems identified during plan implementation or privacy control assessments.

Assessment Methods

Examine

• Privacy program plan
• procedures addressing program plan development and implementation
• procedures addressing program plan reviews, updates, and approvals
• procedures addressing coordination of the program plan with relevant entities
• records of program plan reviews, updates, and approvals
• other relevant documents or records

Interview

• Organizational personnel with privacy program planning and plan implementation responsibilities
• organizational personnel with privacy responsibilities

Povezani zadaci

• NIST -

  EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

  DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.