Navigate

CCI-004386

CCI-004386 Definition

Develop an organization-wide privacy program plan that provides an overview of the agency's privacy program and is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by Organizational operations (including, mission, functions, image, and reputation), Organizational assets, individuals, other organizations, and the Nation.

Validation Procedures

Examine: [SELECT FROM: Privacy program plan; procedures addressing program plan development and implementation; procedures addressing program plan reviews, updates, and approvals; procedures addressing coordination of the program plan with relevant entities; records of program plan reviews, updates, and approvals; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with privacy program planning and plan implementation responsibilities; organizational personnel with privacy responsibilities].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004386.

Control	Description
PM-18	a: Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and: 1: Includes a description of the structure of the privacy program and the resources dedicated to the privacy program; 2: Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements; 3: Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities; 4: Describes management commitment, compliance, and the strategic goals and objectives of the privacy program; 5: Reflects coordination among organizational entities responsible for the different aspects of privacy; and 6: Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and b: Update the plan [the frequency of updates to the privacy program plan is defined;] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.

Control

Description

PM-18

a: Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:
- 1: Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;
- 2: Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;
- 3: Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;
- 4: Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;
- 5: Reflects coordination among organizational entities responsible for the different aspects of privacy; and
- 6: Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and

b: Update the plan [the frequency of updates to the privacy program plan is defined;] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.