CCI-003585

Implementation Guidance

DoDD 5400.11, DoD 5400.11-R, DoDI 5400.16, publication of both Privacy Impact Assessments and System of Records Notices, as well as, if published, Service or DoD Component level privacy regulations, meet this control's requirement to make public information about the organizations' privacy activities. The organization being inspected/assessed documents any Service or Component level privacy regulations it has published.

Validation Procedures

DoDD 5400.11, DoD 5400.11-R, DoDI 5400.16, publication of both Privacy Impact Assessments and System of Records Notices, as well as, if published, Service or DoD Component level privacy regulations, meet this control's to make publicly accessible information about the organizations' privacy activities. The organization conducting the inspection/assessment obtains and examines the published Service or Component level privacy regulations to ensure the organization being inspected/assessed, has made those regulations public.

Compelling Evidence

1.) examples of where organization publishes and documents Privacy Impact Assessments, System of Records Notices, and Service or DoD Component level Privacy regulations in order to make public information about the organization's privacy activities.