Navigate

CCI-004375

CCI-004375 Definition

Disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program and includes a description of the structure of the privacy program and the resources dictated to the privacy program.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - the privacy program plan includes a description of the structure of the privacy program. - the privacy program plan includes a description of the resources dedicated to the privacy program.

Validation Procedures

Examine: [SELECT FROM: Privacy program plan; procedures addressing program plan development and implementation; procedures addressing program plan reviews, updates, and approvals; procedures addressing coordination of the program plan with relevant entities; records of program plan reviews, updates, and approvals; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with privacy program planning and plan implementation responsibilities; organizational personnel with privacy responsibilities].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004375.

Control	Description
PM-18	a: Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and: 1: Includes a description of the structure of the privacy program and the resources dedicated to the privacy program; 2: Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements; 3: Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities; 4: Describes management commitment, compliance, and the strategic goals and objectives of the privacy program; 5: Reflects coordination among organizational entities responsible for the different aspects of privacy; and 6: Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and b: Update the plan [the frequency of updates to the privacy program plan is defined;] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.

Control

Description

PM-18

a: Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:
- 1: Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;
- 2: Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;
- 3: Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;
- 4: Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;
- 5: Reflects coordination among organizational entities responsible for the different aspects of privacy; and
- 6: Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and

b: Update the plan [the frequency of updates to the privacy program plan is defined;] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.