Navigate

CCI-004395

CCI-004395 Definition

Ensure that the public has access to information about organizational privacy activities.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - the webpage ensures that the public has access to information about Organizational privacy activities. - the webpage ensures that the public can communicate with its senior agency official for privacy.

Validation Procedures

Examine: [SELECT FROM: Public website; publicly posted privacy program documents, including policies, procedures, plans, and reports; position description of the senior agency official for privacy; public privacy notices, including Federal Register notices; privacy impact assessments; privacy risk assessments; Privacy Act statements and system of records notices; computer matching agreements and notices; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with privacy program information dissemination responsibilities; organizational personnel with privacy responsibilities]. Test: [SELECT FROM: Location, access, availability, and functionality of privacy resource webpage].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004395.

Control	Description
PM-20	Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that: a: Ensures that the public has access to information about organizational privacy activities and can communicate with its senior agency official for privacy; b: Ensures that organizational privacy practices and reports are publicly available; and c: Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

Control

Description

PM-20

Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that:

a: Ensures that the public has access to information about organizational privacy activities and can communicate with its senior agency official for privacy;

b: Ensures that organizational privacy practices and reports are publicly available; and

c: Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.