Assessment Objective
Determine if:
- SA-04(11) [Assignment: Privacy Act requirements] are defined in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- procedures addressing the integration of Privacy Act requirements into systems of records operated by external organizations
- solicitation documentation
- acquisition documentation
- acquisition contracts for the system, system component, or system service
- service level agreements
- system security plan
- privacy plan
- personally identifiable information processing policy
- privacy program plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel with acquisition responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Contract management processes to verify Privacy Act requirements are defined for the operation of a system of records
- vendor processes for demonstrating incorporation of Privacy Act requirements in its operation of a system of records
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | SA-04(11) System of Records |