Navigate

CCI-004399

CCI-004399 Definition

Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that are written in plain language.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - the privacy policies are written in plain language. - the privacy policies are organized in a way that is easy to understand and navigate.

Validation Procedures

Examine: [SELECT FROM: Privacy program plan; privacy policies on the agency website, mobile applications, and/or other digital services]. Interview: [SELECT FROM: Organizational personnel with privacy program information dissemination responsibilities; organizational personnel with privacy responsibilities]. Test: [SELECT FROM: Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing; organizational procedures and practices for disseminating privacy program information; mechanisms supporting the dissemination of privacy program information].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004399.

Control	Description
PM-20(1)	Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that: (a): Are written in plain language and organized in a way that is easy to understand and navigate; (b): Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and (c): Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes.

Control

Description

PM-20(1)

Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that:

(a): Are written in plain language and organized in a way that is easy to understand and navigate;

(b): Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and

(c): Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes.