+PM [P] Program Management
---+PM-03 [P] Information Security and Privacy Resources
---+PM-04 [P] Plan of Action and Milestones Process
---+PM-05(01) [P] Inventory of Personally Identifiable Information
---+PM-06 [P] Measures of Performance
---+PM-07 [P] Enterprise Architecture
---+PM-08 [P] Critical Infrastructure Plan
---+PM-09 [P] Risk Management Strategy
---+PM-10 [P] Authorization Process
---+PM-11 [P] Mission and Business Process Definition
---+PM-13 [P] Security and Privacy Workforce
---+PM-14 [P] Testing, Training, and Monitoring
---+PM-17 [P] Protecting Controlled Unclassified Information on External Systems
---+PM-18 [P] Privacy Program Plan
---+PM-19 [P] Privacy Program Leadership Role
---+PM-20 [P] Dissemination of Privacy Program Information
------+PM-20(01) [P] Privacy Policies on Websites, Applications, and Digital Services
---+PM-21 [P] Accounting of Disclosures
---+PM-22 [P] Personally Identifiable Information Quality Management
---+PM-24 [P] Data Integrity Board
---+PM-25 [P] Minimization of Personally Identifiable Information Used in Testing, Training, and Research
---+PM-26 [P] Complaint Management
---+PM-27 [P] Privacy Reporting
---+PM-28 [P] Risk Framing
---+PM-31 [P] Continuous Monitoring Strategy

PM [P] Program Management

Program Management

1. Overzicht

PM-03 [P] Information Security and Privacy Resources

Control

  1. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement;
  2. Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and
  3. Make available for expenditure, the planned information security and privacy resources.

Discussion

Organizations consider establishing champions for information security and privacy and, as part of including the necessary resources, assign specialized expertise and resources as needed. Organizations may designate and empower an Investment Review Board or similar group to manage and provide oversight for the information security and privacy aspects of the capital planning and investment control process.

Assessment Objective

    1. the resources needed to implement the information security program are included in capital planning and investment requests, and all exceptions are documented;
    2. the resources needed to implement the privacy program are included in capital planning and investment requests, and all exceptions are documented;
    1. the documentation required for addressing the information security program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;
    2. the documentation required for addressing the privacy program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;
    1. information security resources are made available for expenditure as planned;
    2. privacy resources are made available for expenditure as planned.

Assessment Method

Examine

Information security program plan Exhibit 300 Exhibit 53 business cases for capital planning and investment procedures for capital planning and investment documentation of exceptions to capital planning requirements other relevant documents or records

Interview

Organizational personnel with information security program planning responsibilities organizational personnel with privacy program planning responsibilities organizational personnel responsible for capital planning and investment organizational personnel with information security responsibilities organizational personnel with privacy responsibilities
PM-04 [P] Plan of Action and Milestones Process

Control

  1. Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems:
    1. Are developed and maintained;
    2. Document the remedial information security, privacy, and supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and
    3. Are reported in accordance with established reporting requirements.
  2. Review plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

Discussion

The plan of action and milestones is a key organizational document and is subject to reporting requirements established by the Office of Management and Budget. Organizations develop plans of action and milestones with an organization-wide perspective, prioritizing risk response actions and ensuring consistency with the goals and objectives of the organization. Plan of action and milestones updates are based on findings from control assessments and continuous monitoring activities. There can be multiple plans of action and milestones corresponding to the information system level, mission/business process level, and organizational/governance level. While plans of action and milestones are required for federal organizations, other types of organizations can help reduce risk by documenting and tracking planned remediations. Specific guidance on plans of action and milestones at the system level is provided in [CA-5](#ca-5).

Assessment Objective

      1. a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed;
      2. a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained;
      3. a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed;
      4. a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained;
      5. a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed;
      6. a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained;
      1. a process to ensure that plans of action and milestones for the information security program and associated organizational systems document remedial information security risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
      2. a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
      3. a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
      1. a process to ensure that plans of action and milestones for the information security risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
      2. a process to ensure that plans of action and milestones for the privacy risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
      3. a process to ensure that plans of action and milestones for the supply chain risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
    1. plans of action and milestones are reviewed for consistency with the organizational risk management strategy;
    2. plans of action and milestones are reviewed for consistency with organization-wide priorities for risk response actions.

Assessment Method

Examine

Information security program plan plans of action and milestones procedures addressing plans of action and milestones development and maintenance procedures addressing plans of action and milestones reporting procedures for reviewing plans of action and milestones for consistency with risk management strategy and risk response priorities results of risk assessments associated with plans of action and milestones OMB FISMA reporting requirements other relevant documents or records

Interview

Organizational personnel with responsibilities for developing, maintaining, reviewing, and reporting plans of action and milestones organizational personnel with information security responsibilities
PM-05(01) [P] Inventory of Personally Identifiable Information

Control

Establish, maintain, and update [Assignement: frequency] an inventory of all systems, applications, and projects that process personally identifiable information.

Discussion

An inventory of systems, applications, and projects that process personally identifiable information supports the mapping of data actions, providing individuals with privacy notices, maintaining accurate personally identifiable information, and limiting the processing of personally identifiable information when such information is not needed for operational purposes. Organizations may use this inventory to ensure that systems only process the personally identifiable information for authorized purposes and that this processing is still relevant and necessary for the purpose specified therein.

Assessment Objective

  1. an inventory of all systems, applications, and projects that process personally identifiable information is established;
  2. an inventory of all systems, applications, and projects that process personally identifiable information is maintained;
  3. an inventory of all systems, applications, and projects that process personally identifiable information is updated [Assignement: frequency].

Assessment Method

Examine

Procedures addressing system inventory development, maintenance, and updates OMB FISMA reporting guidance privacy program plan information security program plan personally identifiable information processing policy system inventory personally identifiable information inventory data mapping documentation other relevant documents or records

Interview

Organizational personnel with privacy program planning and plan implementation responsibilities organizational personnel responsible for developing and maintaining the system inventory organizational personnel with information security and privacy responsibilities
PM-06 [P] Measures of Performance

Control

Develop, monitor, and report on the results of information security and privacy measures of performance.

Discussion

Measures of performance are outcome-based metrics used by an organization to measure the effectiveness or efficiency of the information security and privacy programs and the controls employed in support of the program. To facilitate security and privacy risk management, organizations consider aligning measures of performance with the organizational risk tolerance as defined in the risk management strategy.

Assessment Objective

  1. information security measures of performance are developed;
  2. information security measures of performance are monitored;
  3. the results of information security measures of performance are reported;
  4. privacy measures of performance are developed;
  5. privacy measures of performance are monitored;
  6. the results of privacy measures of performance are reported.

Assessment Method

Examine

Information security program plan privacy program plan information security measures of performance privacy measures of performance procedures addressing the development, monitoring, and reporting of information security and privacy measures of performance risk management strategy other relevant documents or records

Interview

Organizational personnel with information security and privacy program planning and plan implementation responsibilities organizational personnel responsible for developing, monitoring, and reporting information security and privacy measures of performance organizational personnel with information security and privacy responsibilities
PM-07 [P] Enterprise Architecture

Control

Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.

Discussion

The integration of security and privacy requirements and controls into the enterprise architecture helps to ensure that security and privacy considerations are addressed throughout the system development life cycle and are explicitly related to the organization’s mission and business processes. The process of security and privacy requirements integration also embeds into the enterprise architecture and the organization’s security and privacy architectures consistent with the organizational risk management strategy. For PM-7, security and privacy architectures are developed at a system-of-systems level, representing all organizational systems. For [PL-8](#pl-8) , the security and privacy architectures are developed at a level that represents an individual system. The system-level architectures are consistent with the security and privacy architectures defined for the organization. Security and privacy requirements and control integration are most effectively accomplished through the rigorous application of the Risk Management Framework [SP 800-37](#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8) and supporting security standards and guidelines.

Assessment Objective

  1. an enterprise architecture is developed with consideration for information security;
  2. an enterprise architecture is maintained with consideration for information security;
  3. an enterprise architecture is developed with consideration for privacy;
  4. an enterprise architecture is maintained with consideration for privacy;
  5. an enterprise architecture is developed with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation;
  6. an enterprise architecture is maintained with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.

Assessment Method

Examine

Information security program plan privacy program plan enterprise architecture documentation procedures addressing enterprise architecture development results of risk assessments of enterprise architecture other relevant documents or records

Interview

Organizational personnel with information security and privacy program planning and plan implementation responsibilities organizational personnel responsible for developing enterprise architecture organizational personnel responsible for risk assessments of enterprise architecture organizational personnel with information security and privacy responsibilities
PM-08 [P] Critical Infrastructure Plan

Control

Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan.

Discussion

Protection strategies are based on the prioritization of critical assets and resources. The requirement and guidance for defining critical infrastructure and key resources and for preparing an associated critical infrastructure protection plan are found in applicable laws, executive orders, directives, policies, regulations, standards, and guidelines.

Assessment Objective

  1. information security issues are addressed in the development of a critical infrastructure and key resources protection plan;
  2. information security issues are addressed in the documentation of a critical infrastructure and key resources protection plan;
  3. information security issues are addressed in the update of a critical infrastructure and key resources protection plan;
  4. privacy issues are addressed in the development of a critical infrastructure and key resources protection plan;
  5. privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan;
  6. privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.

Assessment Method

Examine

Information security program plan privacy program plan critical infrastructure and key resources protection plan procedures addressing the development, documentation, and updating of the critical infrastructure and key resources protection plan HSPD 7 National Infrastructure Protection Plan other relevant documents or records

Interview

Organizational personnel with information security and privacy program planning and plan implementation responsibilities organizational personnel responsible for developing, documenting, and updating the critical infrastructure and key resources protection plan organizational personnel with information security and privacy responsibilities
PM-09 [P] Risk Management Strategy

Control

  1. Develops a comprehensive strategy to manage:
    1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and
    2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information;
  2. Implement the risk management strategy consistently across the organization; and
  3. Review and update the risk management strategy [Assignement: frequency] or as required, to address organizational changes.

Discussion

An organization-wide risk management strategy includes an expression of the security and privacy risk tolerance for the organization, security and privacy risk mitigation strategies, acceptable risk assessment methodologies, a process for evaluating security and privacy risk across the organization with respect to the organization’s risk tolerance, and approaches for monitoring risk over time. The senior accountable official for risk management (agency head or designated official) aligns information security management processes with strategic, operational, and budgetary planning processes. The risk executive function, led by the senior accountable official for risk management, can facilitate consistent application of the risk management strategy organization-wide. The risk management strategy can be informed by security and privacy risk-related inputs from other sources, both internal and external to the organization, to ensure that the strategy is broad-based and comprehensive. The supply chain risk management strategy described in [PM-30](#pm-30) can also provide useful inputs to the organization-wide risk management strategy.

Assessment Objective

    1. a comprehensive strategy is developed to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems;
    2. a comprehensive strategy is developed to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information;
  2. the risk management strategy is implemented consistently across the organization;
  3. the risk management strategy is reviewed and updated [Assignement: frequency] or as required to address organizational changes.

Assessment Method

Examine

Information security program plan privacy program plan risk management strategy supply chain risk management strategy procedures addressing the development, implementation, review, and update of the risk management strategy risk assessment results relevant to the risk management strategy other relevant documents or records

Interview

Organizational personnel with information security and privacy program planning and plan implementation responsibilities organizational personnel responsible for the development, implementation, review, and update of the risk management strategy organizational personnel with information security and privacy responsibilities
PM-10 [P] Authorization Process

Control

  1. Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes;
  2. Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process; and
  3. Integrate the authorization processes into an organization-wide risk management program.

Discussion

Authorization processes for organizational systems and environments of operation require the implementation of an organization-wide risk management process and associated security and privacy standards and guidelines. Specific roles for risk management processes include a risk executive (function) and designated authorizing officials for each organizational system and common control provider. The authorization processes for the organization are integrated with continuous monitoring processes to facilitate ongoing understanding and acceptance of security and privacy risks to organizational operations, organizational assets, individuals, other organizations, and the Nation.

Assessment Objective

    1. the security state of organizational systems and the environments in which those systems operate are managed through authorization processes;
    2. the privacy state of organizational systems and the environments in which those systems operate are managed through authorization processes;
  2. individuals are designated to fulfill specific roles and responsibilities within the organizational risk management process;
  3. the authorization processes are integrated into an organization-wide risk management program.

Assessment Method

Examine

Information security program plan privacy program plan procedures addressing management (i.e., documentation, tracking, and reporting) of the authorization process assessment, authorization, and monitoring policy assessment, authorization, and monitoring procedures system authorization documentation lists or other documentation about authorization process roles and responsibilities risk assessment results relevant to the authorization process and the organization-wide risk management program organizational risk management strategy other relevant documents or records

Interview

Organizational personnel with information security and privacy program planning and plan implementation responsibilities organizational personnel responsible for management of the authorization process organizational personnel with information security and privacy responsibilities
PM-11 [P] Mission and Business Process Definition

Control

  1. Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and
  2. Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and
  3. Review and revise the mission and business processes [Assignement: frequency].

Discussion

Protection needs are technology-independent capabilities that are required to counter threats to organizations, individuals, systems, and the Nation through the compromise of information (i.e., loss of confidentiality, integrity, availability, or privacy). Information protection and personally identifiable information processing needs are derived from the mission and business needs defined by organizational stakeholders, the mission and business processes designed to meet those needs, and the organizational risk management strategy. Information protection and personally identifiable information processing needs determine the required controls for the organization and the systems. Inherent to defining protection and personally identifiable information processing needs is an understanding of the adverse impact that could result if a compromise or breach of information occurs. The categorization process is used to make such potential impact determinations. Privacy risks to individuals can arise from the compromise of personally identifiable information, but they can also arise as unintended consequences or a byproduct of the processing of personally identifiable information at any stage of the information life cycle. Privacy risk assessments are used to prioritize the risks that are created for individuals from system processing of personally identifiable information. These risk assessments enable the selection of the required privacy controls for the organization and systems. Mission and business process definitions and the associated protection requirements are documented in accordance with organizational policies and procedures.

Assessment Objective

    1. organizational mission and business processes are defined with consideration for information security;
    2. organizational mission and business processes are defined with consideration for privacy;
    3. organizational mission and business processes are defined with consideration for the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation;
    1. information protection needs arising from the defined mission and business processes are determined;
    2. personally identifiable information processing needs arising from the defined mission and business processes are determined;
  3. the mission and business processes are reviewed and revised [Assignement: frequency].

Assessment Method

Examine

Information security program plan privacy program plan risk management strategy procedures for determining mission and business protection needs information security and privacy risk assessment results relevant to the determination of mission and business protection needs personally identifiable information processing policy personally identifiable information inventory other relevant documents or records

Interview

Organizational personnel with information security and privacy program planning and plan implementation responsibilities organizational personnel responsible for enterprise risk management organizational personnel responsible for determining information protection needs for mission and business processes organizational personnel with information security and privacy responsibilities
PM-13 [P] Security and Privacy Workforce

Control

Establish a security and privacy workforce development and improvement program.

Discussion

Security and privacy workforce development and improvement programs include defining the knowledge, skills, and abilities needed to perform security and privacy duties and tasks; developing role-based training programs for individuals assigned security and privacy roles and responsibilities; and providing standards and guidelines for measuring and building individual qualifications for incumbents and applicants for security- and privacy-related positions. Such workforce development and improvement programs can also include security and privacy career paths to encourage security and privacy professionals to advance in the field and fill positions with greater responsibility. The programs encourage organizations to fill security- and privacy-related positions with qualified personnel. Security and privacy workforce development and improvement programs are complementary to organizational security awareness and training programs and focus on developing and institutionalizing the core security and privacy capabilities of personnel needed to protect organizational operations, assets, and individuals.

Assessment Objective

  1. a security workforce development and improvement program is established;
  2. a privacy workforce development and improvement program is established.

Assessment Method

Examine

Information security program plan privacy program plan information security and privacy workforce development and improvement program documentation procedures for the information security and privacy workforce development and improvement program information security and privacy role-based training program documentation other relevant documents or records

Interview

Organizational personnel with information security and privacy program planning and plan implementation responsibilities organizational personnel responsible for the information security and privacy workforce development and improvement program organizational personnel with information security and privacy responsibilities
PM-14 [P] Testing, Training, and Monitoring

Control

  1. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems:
    1. Are developed and maintained; and
    2. Continue to be executed; and
  2. Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

Discussion

A process for organization-wide security and privacy testing, training, and monitoring helps ensure that organizations provide oversight for testing, training, and monitoring activities and that those activities are coordinated. With the growing importance of continuous monitoring programs, the implementation of information security and privacy across the three levels of the risk management hierarchy and the widespread use of common controls, organizations coordinate and consolidate the testing and monitoring activities that are routinely conducted as part of ongoing assessments supporting a variety of controls. Security and privacy training activities, while focused on individual systems and specific roles, require coordination across all organizational elements. Testing, training, and monitoring plans and activities are informed by current threat and vulnerability assessments.

Assessment Objective

      1. a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed;
      2. a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained;
      3. a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed;
      4. a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained;
      1. a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems continue to be executed;
      2. a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems continue to be executed;
    1. testing plans are reviewed for consistency with the organizational risk management strategy;
    2. training plans are reviewed for consistency with the organizational risk management strategy;
    3. monitoring plans are reviewed for consistency with the organizational risk management strategy;
    4. testing plans are reviewed for consistency with organization-wide priorities for risk response actions;
    5. training plans are reviewed for consistency with organization-wide priorities for risk response actions;
    6. monitoring plans are reviewed for consistency with organization-wide priorities for risk response actions.

Assessment Method

Examine

Information security program plan privacy program plan plans for conducting security and privacy testing, training, and monitoring activities organizational procedures addressing the development and maintenance of plans for conducting security and privacy testing, training, and monitoring activities risk management strategy procedures for the review of plans for conducting security and privacy testing, training, and monitoring activities for consistency with risk management strategy and risk response priorities results of risk assessments associated with conducting security and privacy testing, training, and monitoring activities documentation of the timely execution of plans for conducting security and privacy testing, training, and monitoring activities other relevant documents or records

Interview

Organizational personnel with responsibilities for developing and maintaining plans for conducting security and privacy testing, training, and monitoring activities organizational personnel with information security and privacy responsibilities
PM-17 [P] Protecting Controlled Unclassified Information on External Systems

Control

  1. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and
  2. Review and update the policy and procedures [Assignement: organization-defined frequency].

Discussion

Controlled unclassified information is defined by the National Archives and Records Administration along with the safeguarding and dissemination requirements for such information and is codified in [32 CFR 2002](#91f992fb-f668-4c91-a50f-0f05b95ccee3) and, specifically for systems external to the federal organization, [32 CFR 2002.14h](https://www.govinfo.gov/content/pkg/CFR-2017-title32-vol6/xml/CFR-2017-title32-vol6-part2002.xml) . The policy prescribes the specific use and conditions to be implemented in accordance with organizational procedures, including via its contracting processes.

Assessment Objective

    1. policy is established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
    2. procedures are established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
    1. policy is reviewed and updated [Assignement: frequency];
    2. procedures are reviewed and updated [Assignement: frequency]

Assessment Method

Examine

Controlled unclassified information policy controlled unclassified information procedures other relevant documents or records.

Interview

Organizational personnel with controlled unclassified information responsibilities organizational personnel with information security responsibilities.
PM-18 [P] Privacy Program Plan

Control

  1. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:
    1. Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;
    2. Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;
    3. Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;
    4. Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;
    5. Reflects coordination among organizational entities responsible for the different aspects of privacy; and
    6. Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and
  2. Update the plan [Assignement: frequency] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.

Discussion

A privacy program plan is a formal document that provides an overview of an organization’s privacy program, including a description of the structure of the privacy program, the resources dedicated to the privacy program, the role of the senior agency official for privacy and other privacy officials and staff, the strategic goals and objectives of the privacy program, and the program management controls and common controls in place or planned for meeting applicable privacy requirements and managing privacy risks. Privacy program plans can be represented in single documents or compilations of documents. The senior agency official for privacy is responsible for designating which privacy controls the organization will treat as program management, common, system-specific, and hybrid controls. Privacy program plans provide sufficient information about the privacy program management and common controls (including the specification of parameters and assignment and selection operations explicitly or by reference) to enable control implementations that are unambiguously compliant with the intent of the plans and a determination of the risk incurred if the plans are implemented as intended. Program management controls are generally implemented at the organization level and are essential for managing the organization’s privacy program. Program management controls are distinct from common, system-specific, and hybrid controls because program management controls are independent of any particular information system. Together, the privacy plans for individual systems and the organization-wide privacy program plan provide complete coverage for the privacy controls employed within the organization. Common controls are documented in an appendix to the organization’s privacy program plan unless the controls are included in a separate privacy plan for a system. The organization-wide privacy program plan indicates which separate privacy plans contain descriptions of privacy controls.

Assessment Objective

    1. an organization-wide privacy program plan that provides an overview of the agency’s privacy program is developed;
      1. the privacy program plan includes a description of the structure of the privacy program;
      2. the privacy program plan includes a description of the resources dedicated to the privacy program;
      1. the privacy program plan provides an overview of the requirements for the privacy program;
      2. the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program;
      3. the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program;
      1. the privacy program plan includes the role of the senior agency official for privacy;
      2. the privacy program plan includes the identification and assignment of the roles of other privacy officials and staff and their responsibilities;
      1. the privacy program plan describes management commitment;
      2. the privacy program plan describes compliance;
      3. the privacy program plan describes the strategic goals and objectives of the privacy program;
    6. the privacy program plan reflects coordination among organizational entities responsible for the different aspects of privacy;
    7. the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by organizational operations (including, mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
    8. the privacy program plan is disseminated;
    1. the privacy program plan is updated [Assignement: frequency];
    2. the privacy program plan is updated to address changes in federal privacy laws and policies;
    3. the privacy program plan is updated to address organizational changes;
    4. the privacy program plan is updated to address problems identified during plan implementation or privacy control assessments.

Assessment Method

Examine

Privacy program plan procedures addressing program plan development and implementation procedures addressing program plan reviews, updates, and approvals procedures addressing coordination of the program plan with relevant entities records of program plan reviews, updates, and approvals other relevant documents or records

Interview

Organizational personnel with privacy program planning and plan implementation responsibilities organizational personnel with privacy responsibilities
PM-19 [P] Privacy Program Leadership Role

Control

Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program.

Discussion

The privacy officer is an organizational official. For federal agencies—as defined by applicable laws, executive orders, directives, regulations, policies, standards, and guidelines—this official is designated as the senior agency official for privacy. Organizations may also refer to this official as the chief privacy officer. The senior agency official for privacy also has roles on the data management board (see [PM-23](#pm-23) ) and the data integrity board (see [PM-24](#pm-24)).

Assessment Objective

  1. a senior agency official for privacy with authority, mission, accountability, and resources is appointed;
  2. the senior agency official for privacy coordinates applicable privacy requirements;
  3. the senior agency official for privacy develops applicable privacy requirements;
  4. the senior agency official for privacy implements applicable privacy requirements;
  5. the senior agency official for privacy manages privacy risks through the organization-wide privacy program.

Assessment Method

Examine

Privacy program documents, including policies, procedures, plans, and reports public privacy notices, including Federal Register notices privacy impact assessments privacy risk assessments Privacy Act statements system of records notices computer matching agreements and notices contracts, information sharing agreements, and memoranda of understanding governing requirements, including laws, executive orders, regulations, standards, and guidance other relevant documents or records

Interview

Organizational personnel with privacy program planning and plan implementation responsibilities organizational personnel with privacy responsibilities senior agency official for privacy privacy officials
PM-20 [P] Dissemination of Privacy Program Information

Control

Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that:
  1. Ensures that the public has access to information about organizational privacy activities and can communicate with its senior agency official for privacy;
  2. Ensures that organizational privacy practices and reports are publicly available; and
  3. Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

Discussion

For federal agencies, the webpage is located at www.[agency].gov/privacy. Federal agencies include public privacy impact assessments, system of records notices, computer matching notices and agreements, [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) exemption and implementation rules, privacy reports, privacy policies, instructions for individuals making an access or amendment request, email addresses for questions/complaints, blogs, and periodic publications.

Assessment Objective

  1. a central resource webpage is maintained on the organization’s principal public website;
  2. the webpage serves as a central source of information about the organization’s privacy program;
    1. the webpage ensures that the public has access to information about organizational privacy activities;
    2. the webpage ensures that the public can communicate with its senior agency official for privacy;
    1. the webpage ensures that organizational privacy practices are publicly available;
    2. the webpage ensures that organizational privacy reports are publicly available;
  5. the webpage employs publicly facing email addresses and/or phone numbers to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

Assessment Method

Examine

Public website publicly posted privacy program documents, including policies, procedures, plans, and reports position description of the senior agency official for privacy public privacy notices, including Federal Register notices privacy impact assessments privacy risk assessments Privacy Act statements and system of records notices computer matching agreements and notices other relevant documents or records

Interview

Organizational personnel with privacy program information dissemination responsibilities organizational personnel with privacy responsibilities
PM-21 [P] Accounting of Disclosures

Control

  1. Develop and maintain an accurate accounting of disclosures of personally identifiable information, including:
    1. Date, nature, and purpose of each disclosure; and
    2. Name and address, or other contact information of the individual or organization to which the disclosure was made;
  2. Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer; and
  3. Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.

Discussion

The purpose of accounting of disclosures is to allow individuals to learn to whom their personally identifiable information has been disclosed, to provide a basis for subsequently advising recipients of any corrected or disputed personally identifiable information, and to provide an audit trail for subsequent reviews of organizational compliance with conditions for disclosures. For federal agencies, keeping an accounting of disclosures is required by the [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) ; agencies should consult with their senior agency official for privacy and legal counsel on this requirement and be aware of the statutory exceptions and OMB guidance relating to the provision. Organizations can use any system for keeping notations of disclosures, if it can construct from such a system, a document listing of all disclosures along with the required information. Automated mechanisms can be used by organizations to determine when personally identifiable information is disclosed, including commercial services that provide notifications and alerts. Accounting of disclosures may also be used to help organizations verify compliance with applicable privacy statutes and policies governing the disclosure or dissemination of information and dissemination restrictions.

Assessment Objective

  1. an accurate accounting of disclosures of personally identifiable information is developed and maintained;
      1. the accounting includes the date of each disclosure;
      2. the accounting includes the nature of each disclosure;
      3. the accounting includes the purpose of each disclosure;
      1. the accounting includes the name of the individual or organization to whom the disclosure was made;
      2. the accounting includes the address or other contact information of the individual or organization to whom the disclosure was made;
  2. the accounting of disclosures is retained for the length of time that the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer;
  3. the accounting of disclosures is made available to the individual to whom the personally identifiable information relates upon request.

Assessment Method

Examine

Privacy program plan disclosure policies and procedures records of disclosures audit logs Privacy Act policies and procedures system of records notice Privacy Act exemption rules.

Interview

Organizational personnel with privacy program responsibilities organizational personnel with privacy responsibilities.
PM-22 [P] Personally Identifiable Information Quality Management

Control

Develop and document organization-wide policies and procedures for:
  1. Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle;
  2. Correcting or deleting inaccurate or outdated personally identifiable information;
  3. Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and
  4. Appeals of adverse decisions on correction or deletion requests.

Discussion

Personally identifiable information quality management includes steps that organizations take to confirm the accuracy and relevance of personally identifiable information throughout the information life cycle. The information life cycle includes the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposition of personally identifiable information. Organizational policies and procedures for personally identifiable information quality management are important because inaccurate or outdated personally identifiable information maintained by organizations may cause problems for individuals. Organizations consider the quality of personally identifiable information involved in business functions where inaccurate information may result in adverse decisions or the denial of benefits and services, or the disclosure of the information may cause stigmatization. Correct information, in certain circumstances, can cause problems for individuals that outweigh the benefits of organizations maintaining the information. Organizations consider creating policies and procedures for the removal of such information. The senior agency official for privacy ensures that practical means and mechanisms exist and are accessible for individuals or their authorized representatives to seek the correction or deletion of personally identifiable information. Processes for correcting or deleting data are clearly defined and publicly available. Organizations use discretion in determining whether data is to be deleted or corrected based on the scope of requests, the changes sought, and the impact of the changes. Additionally, processes include the provision of responses to individuals of decisions to deny requests for correction or deletion. The responses include the reasons for the decisions, a means to record individual objections to the decisions, and a means of requesting reviews of the initial determinations. Organizations notify individuals or their designated representatives when their personally identifiable information is corrected or deleted to provide transparency and confirm the completed action. Due to the complexity of data flows and storage, other entities may need to be informed of the correction or deletion. Notice supports the consistent correction and deletion of personally identifiable information across the data ecosystem.

Assessment Objective

  1. organization-wide policies for personally identifiable information quality management are developed and documented;
  2. organization-wide procedures for personally identifiable information quality management are developed and documented;
    1. the policies address reviewing the accuracy of personally identifiable information across the information life cycle;
    2. the policies address reviewing the relevance of personally identifiable information across the information life cycle;
    3. the policies address reviewing the timeliness of personally identifiable information across the information life cycle;
    4. the policies address reviewing the completeness of personally identifiable information across the information life cycle;
    5. the procedures address reviewing the accuracy of personally identifiable information across the information life cycle;
    6. the procedures address reviewing the relevance of personally identifiable information across the information life cycle;
    7. the procedures address reviewing the timeliness of personally identifiable information across the information life cycle;
    8. the procedures address reviewing the completeness of personally identifiable information across the information life cycle;
    1. the policies address correcting or deleting inaccurate or outdated personally identifiable information;
    2. the procedures address correcting or deleting inaccurate or outdated personally identifiable information;
    1. the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
    2. the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
    1. the policies address appeals of adverse decisions on correction or deletion requests;
    2. the procedures address appeals of adverse decisions on correction or deletion requests.

Assessment Method

Examine

Privacy program plan policies and procedures addressing personally identifiable information quality management, information life cycle documentation, and sample notices of correction or deletion records of monitoring PII quality management practices documentation of reviews and updates of policies and procedures

Interview

Organizational personnel with privacy program information dissemination responsibilities organizational personnel with privacy responsibilities
PM-24 [P] Data Integrity Board

Control

Establish a Data Integrity Board to:
  1. Review proposals to conduct or participate in a matching program; and
  2. Conduct an annual review of all matching programs in which the agency has participated.

Discussion

A Data Integrity Board is the board of senior officials designated by the head of a federal agency and is responsible for, among other things, reviewing the agency’s proposals to conduct or participate in a matching program and conducting an annual review of all matching programs in which the agency has participated. As a general matter, a matching program is a computerized comparison of records from two or more automated [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) systems of records or an automated system of records and automated records maintained by a non-federal agency (or agent thereof). A matching program either pertains to Federal benefit programs or Federal personnel or payroll records. At a minimum, the Data Integrity Board includes the Inspector General of the agency, if any, and the senior agency official for privacy.

Assessment Objective

a Data Integrity Board is established;
  1. the Data Integrity Board reviews proposals to conduct or participate in a matching program;
  2. the Data Integrity Board conducts an annual review of all matching programs in which the agency has participated.

Assessment Method

Examine

Privacy program plan privacy program documents relating to the Data Integrity Board, including documents establishing the board, its charter of operations, and any plans and reports computer matching agreements and notices information sharing agreements memoranda of understanding records documenting annual reviews governing requirements, including laws, executive orders, regulations, standards, and guidance

Interview

members of the Data Integrity Board (e.g., the chief information officer, senior information security officer, senior agency official for privacy, and agency Inspector General)
PM-25 [P] Minimization of Personally Identifiable Information Used in Testing, Training, and Research

Control

  1. Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research;
  2. Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes;
  3. Authorize the use of personally identifiable information when such information is required for internal testing, training, and research; and
  4. Review and update policies and procedures [Assignement: organization-defined frequency].

Discussion

The use of personally identifiable information in testing, research, and training increases the risk of unauthorized disclosure or misuse of such information. Organizations consult with the senior agency official for privacy and/or legal counsel to ensure that the use of personally identifiable information in testing, training, and research is compatible with the original purpose for which it was collected. When possible, organizations use placeholder data to avoid exposure of personally identifiable information when conducting testing, training, and research.

Assessment Objective

    1. policies that address the use of personally identifiable information for internal testing are developed and documented;
    2. policies that address the use of personally identifiable information for internal training are developed and documented;
    3. policies that address the use of personally identifiable information for internal research are developed and documented;
    4. procedures that address the use of personally identifiable information for internal testing are developed and documented;
    5. procedures that address the use of personally identifiable information for internal training are developed and documented;
    6. procedures that address the use of personally identifiable information for internal research are developed and documented;
    7. policies that address the use of personally identifiable information for internal testing, are implemented;
    8. policies that address the use of personally identifiable information for training are implemented;
    9. policies that address the use of personally identifiable information for research are implemented;
    10. procedures that address the use of personally identifiable information for internal testing are implemented;
    11. procedures that address the use of personally identifiable information for training are implemented;
    12. procedures that address the use of personally identifiable information for research are implemented;
    1. the amount of personally identifiable information used for internal testing purposes is limited or minimized;
    2. the amount of personally identifiable information used for internal training purposes is limited or minimized;
    3. the amount of personally identifiable information used for internal research purposes is limited or minimized;
    1. the required use of personally identifiable information for internal testing is authorized;
    2. the required use of personally identifiable information for internal training is authorized;
    3. the required use of personally identifiable information for internal research is authorized;
    1. policies are reviewed [Assignement: frequency];
    2. policies are updated [Assignement: frequency];
    3. procedures are reviewed [Assignement: frequency];
    4. procedures are updated [Assignement: frequency].

Assessment Method

Examine

Privacy program plan policies and procedures for the minimization of personally identifiable information used in testing, training, and research documentation supporting policy implementation (e.g., templates for testing, training, and research privacy threshold analysis privacy risk assessment) data sets used for testing, training, and research

Interview

Organizational personnel with privacy program responsibilities organizational personnel with privacy responsibilities system developers personnel with IRB responsibilities
PM-26 [P] Complaint Management

Control

Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes:
  1. Mechanisms that are easy to use and readily accessible by the public;
  2. All information necessary for successfully filing complaints;
  3. Tracking mechanisms to ensure all complaints received are reviewed and addressed within [Assignement: organization-defined time period];
  4. Acknowledgement of receipt of complaints, concerns, or questions from individuals within [Assignement: time period] ; and
  5. Response to complaints, concerns, or questions from individuals within [Assignement: time period].

Discussion

Complaints, concerns, and questions from individuals can serve as valuable sources of input to organizations and ultimately improve operational models, uses of technology, data collection practices, and controls. Mechanisms that can be used by the public include telephone hotline, email, or web-based forms. The information necessary for successfully filing complaints includes contact information for the senior agency official for privacy or other official designated to receive complaints. Privacy complaints may also include personally identifiable information which is handled in accordance with relevant policies and processes.

Assessment Objective

  1. a process for receiving complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;
  2. a process for responding to complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;
    1. the complaint management process includes mechanisms that are easy to use by the public;
    2. the complaint management process includes mechanisms that are readily accessible by the public;
  4. the complaint management process includes all information necessary for successfully filing complaints;
    1. the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within [Assignement: time period];
    2. the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within [Assignement: time period];
  6. the complaint management process includes acknowledging the receipt of complaints, concerns, or questions from individuals within [Assignement: time period];
  7. the complaint management process includes responding to complaints, concerns, or questions from individuals within [Assignement: time period].

Assessment Method

Examine

Privacy program plan procedures addressing complaint management complaint documentation procedures addressing the reviews of complaints other relevant documents or records

Interview

Organizational personnel with privacy program responsibilities organizational personnel with privacy responsibilities
PM-27 [P] Privacy Reporting

Control

  1. Develop [Assignement: privacy reports] and disseminate to:
    1. [Assignement: oversight bodies] to demonstrate accountability with statutory, regulatory, and policy privacy mandates; and
    2. [Assignement: officials] and other personnel with responsibility for monitoring privacy program compliance; and
  2. Review and update privacy reports [Assignement: frequency].

Discussion

Through internal and external reporting, organizations promote accountability and transparency in organizational privacy operations. Reporting can also help organizations to determine progress in meeting privacy compliance requirements and privacy controls, compare performance across the federal government, discover vulnerabilities, identify gaps in policy and implementation, and identify models for success. For federal agencies, privacy reports include annual senior agency official for privacy reports to OMB, reports to Congress required by Implementing Regulations of the 9/11 Commission Act, and other public reports required by law, regulation, or policy, including internal policies of organizations. The senior agency official for privacy consults with legal counsel, where appropriate, to ensure that organizations meet all applicable privacy reporting requirements.

Assessment Objective

  1. [Assignement: privacy reports] are developed;
    1. the privacy reports are disseminated to [Assignement: oversight bodies] to demonstrate accountability with statutory, regulatory, and policy privacy mandates;
      1. the privacy reports are disseminated to [Assignement: officials];
      2. the privacy reports are disseminated to other personnel responsible for monitoring privacy program compliance;
  2. the privacy reports are reviewed and updated [Assignement: frequency].

Assessment Method

Examine

Privacy program plan internal and external privacy reports privacy program plan annual senior agency official for privacy reports to OMB reports to Congress required by law, regulation, or policy, including internal policies records documenting the dissemination of reports to oversight bodies and officials responsible for monitoring privacy program compliance records of review and updates of privacy reports.

Interview

Organizational personnel with privacy program responsibilities organizational personnel with privacy responsibilities legal counsel.
PM-28 [P] Risk Framing

Control

  1. Identify and document:
    1. Assumptions affecting risk assessments, risk responses, and risk monitoring;
    2. Constraints affecting risk assessments, risk responses, and risk monitoring;
    3. Priorities and trade-offs considered by the organization for managing risk; and
    4. Organizational risk tolerance;
  2. Distribute the results of risk framing activities to [Assignement: personnel] ; and
  3. Review and update risk framing considerations [Assignement: frequency].

Discussion

Risk framing is most effective when conducted at the organization level and in consultation with stakeholders throughout the organization including mission, business, and system owners. The assumptions, constraints, risk tolerance, priorities, and trade-offs identified as part of the risk framing process inform the risk management strategy, which in turn informs the conduct of risk assessment, risk response, and risk monitoring activities. Risk framing results are shared with organizational personnel, including mission and business owners, information owners or stewards, system owners, authorizing officials, senior agency information security officer, senior agency official for privacy, and senior accountable official for risk management.

Assessment Objective

      1. assumptions affecting risk assessments are identified and documented;
      2. assumptions affecting risk responses are identified and documented;
      3. assumptions affecting risk monitoring are identified and documented;
      1. constraints affecting risk assessments are identified and documented;
      2. constraints affecting risk responses are identified and documented;
      3. constraints affecting risk monitoring are identified and documented;
      1. priorities considered by the organization for managing risk are identified and documented;
      2. trade-offs considered by the organization for managing risk are identified and documented;
    4. organizational risk tolerance is identified and documented;
  2. the results of risk framing activities are distributed to [Assignement: personnel];
  3. risk framing considerations are reviewed and updated [Assignement: frequency].

Assessment Method

Examine

Information security program plan privacy program plan supply chain risk management strategy documentation of risk framing activities policies and procedures for risk framing activities risk management strategy

Interview

Organizational personnel (including mission, business, and system owners or stewards authorizing officials senior agency information security officer senior agency official for privacy and senior accountable official for risk management)
PM-31 [P] Continuous Monitoring Strategy

Control

Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include:
  1. Establishing the following organization-wide metrics to be monitored: [Assignement: metrics];
  2. Establishing [Assignement: monitoring frequencies] and [Assignement: assessment frequencies] for control effectiveness;
  3. Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy;
  4. Correlation and analysis of information generated by control assessments and monitoring;
  5. Response actions to address results of the analysis of control assessment and monitoring information; and
  6. Reporting the security and privacy status of organizational systems to [Assignement: organization-defined personnel or roles] [Assignement: organization-defined frequency].

Discussion

Continuous monitoring at the organization level facilitates ongoing awareness of the security and privacy posture across the organization to support organizational risk management decisions. The terms "continuous" and "ongoing" imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring guide and inform risk response actions by organizations. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security- and privacy-related information on a continuing basis through reports and dashboards gives organizational officials the capability to make effective, timely, and informed risk management decisions, including ongoing authorization decisions. To further facilitate security and privacy risk management, organizations consider aligning organization-defined monitoring metrics with organizational risk tolerance as defined in the risk management strategy. Monitoring requirements, including the need for monitoring, may be referenced in other controls and control enhancements such as, [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-2(7)(b)](#ac-2.7_smt.b), [AC-2(7)(c)](#ac-2.7_smt.c), [AC-17(1)](#ac-17.1), [AT-4a](#at-4_smt.a), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CA-7](#ca-7), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [CM-11c](#cm-11_smt.c), [IR-5](#ir-5), [MA-2b](#ma-2_smt.b), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [PE-3d](#pe-3_smt.d), [PE-6](#pe-6), [PE-14b](#pe-14_smt.b), [PE-16](#pe-16), [PE-20](#pe-20), [PM-6](#pm-6), [PM-23](#pm-23), [PS-7e](#ps-7_smt.e), [SA-9c](#sa-9_smt.c), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b), [SI-4](#si-4).

Assessment Objective

an organization-wide continuous monitoring strategy is developed;
  1. continuous monitoring programs are implemented that include establishing [Assignement: metrics] to be monitored;
    1. continuous monitoring programs are implemented that establish [Assignement: monitoring frequencies] for monitoring;
    2. continuous monitoring programs are implemented that establish [Assignement: assessment frequencies] for assessment of control effectiveness;
  3. continuous monitoring programs are implemented that include monitoring [Assignement: metrics] on an ongoing basis in accordance with the continuous monitoring strategy;
    1. continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring;
    2. continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring;
    1. continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information;
    2. continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information;
    1. continuous monitoring programs are implemented that include reporting the security status of organizational systems to [Assignement: personnel or roles] [Assignement: frequency];
    2. continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [Assignement: personnel or roles] [Assignement: frequency].

Assessment Method

Examine

Information security program plan privacy program plan supply chain risk management plan continuous monitoring strategy risk management strategy information security continuous monitoring program documentation, reporting, metrics, and artifacts information security continuous monitoring program assessment documentation, reporting, metrics, and artifacts assessment and authorization policy procedures addressing the continuous monitoring of controls privacy program continuous monitoring documentation, reporting, metrics, and artifacts continuous monitoring program records, security, and privacy impact analyses status reports risk response documentation other relevant documents or records.

Interview

Senior Accountable Official for Risk Management chief information officer senior agency information security officer senior agency official for privacy organizational personnel with information security, privacy, and supply chain risk management program responsibilities

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

Eisen

3. Gerelateerde regelingen

Regelingen