Navigate

CCI-004401

CCI-004401 Definition

Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services that provide information needed by the public to make an informed about whether and how to interact with the organization.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - the privacy policies provide the information needed by the public to make an informed decision about whether to interact with the organization. - the privacy policies provide the information needed by the public to make an informed decision about how to interact with the organization.

Validation Procedures

Examine: [SELECT FROM: Privacy program plan; privacy policies on the agency website, mobile applications, and/or other digital services]. Interview: [SELECT FROM: Organizational personnel with privacy program information dissemination responsibilities; organizational personnel with privacy responsibilities]. Test: [SELECT FROM: Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing; organizational procedures and practices for disseminating privacy program information; mechanisms supporting the dissemination of privacy program information].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004401.

Control	Description
PM-20(1)	Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that: (a): Are written in plain language and organized in a way that is easy to understand and navigate; (b): Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and (c): Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes.

Control

Description

PM-20(1)

Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that:

(a): Are written in plain language and organized in a way that is easy to understand and navigate;

(b): Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and

(c): Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes.