Assessment Objective

Determine if:

• PM-21a. an accurate accounting of disclosures of personally identifiable information is developed and maintained;
  • PM-21a.01
    • PM-21a.01[01] the accounting includes the date of each disclosure;
    • PM-21a.01[02] the accounting includes the nature of each disclosure;
    • PM-21a.01[03] the accounting includes the purpose of each disclosure;
  • PM-21a.02
    • PM-21a.02[01] the accounting includes the name of the individual or organization to whom the disclosure was made;
    • PM-21a.02[02] the accounting includes the address or other contact information of the individual or organization to whom the disclosure was made;
• PM-21b. the accounting of disclosures is retained for the length of time that the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer;
• PM-21c. the accounting of disclosures is made available to the individual to whom the personally identifiable information relates upon request.

Assessment Methods

Examine

• Privacy program plan
• disclosure policies and procedures
• records of disclosures
• audit logs
• Privacy Act policies and procedures
• system of records notice
• Privacy Act exemption rules.

Interview

• Organizational personnel with privacy program responsibilities
• organizational personnel with privacy responsibilities.

Test

• Organizational processes for disclosures
• mechanisms supporting the accounting of disclosures, including commercial services that provide notifications and alerts.

Povezane zadeve

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final