Assessment Objective

Determine if:

• SA-04(11) [Assignment: Privacy Act requirements] are defined in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.

Assessment Methods

Examine

• System and services acquisition policy
• system and services acquisition procedures
• procedures addressing the integration of Privacy Act requirements into systems of records operated by external organizations
• solicitation documentation
• acquisition documentation
• acquisition contracts for the system, system component, or system service
• service level agreements
• system security plan
• privacy plan
• personally identifiable information processing policy
• privacy program plan
• privacy impact assessment
• privacy risk assessment documentation
• other relevant documents or records

Interview

• Organizational personnel with acquisition responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Contract management processes to verify Privacy Act requirements are defined for the operation of a system of records
• vendor processes for demonstrating incorporation of Privacy Act requirements in its operation of a system of records

Prepojené úlohy

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final