Navigate

CCI-004441

CCI-004441 Definition

Defines the time period of which the tracking mechanisms to ensure all complaints received are reviewed and addressed.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within [PM-26_ODP[01]; the time period in which complaints (including concerns or questions) from individuals are to be reviewed is defined]. - the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within [PM-26_ODP[02]; the time period in which complaints (including concerns or questions) from individuals are to be addressed is defined].

Validation Procedures

Examine: [SELECT FROM: Privacy program plan; procedures addressing complaint management; complaint documentation; procedures addressing the reviews of complaints; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with privacy program responsibilities; organizational personnel with privacy responsibilities]. Test: [SELECT FROM: Organizational processes for complaint management; mechanisms supporting complaint management; tools used by the public to submit complaints, concerns, and questions (e.g., telephone, hotline, email, or web-based forms].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004441.

Control	Description
PM-26	Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes: a: Mechanisms that are easy to use and readily accessible by the public; b: All information necessary for successfully filing complaints; c: Tracking mechanisms to ensure all complaints received are reviewed and addressed within [one of ]; d: Acknowledgement of receipt of complaints, concerns, or questions from individuals within [the time period for acknowledging the receipt of complaints is defined;] ; and e: Response to complaints, concerns, or questions from individuals within [the time period for responding to complaints is defined;].

Control

Description

PM-26

Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes:

a: Mechanisms that are easy to use and readily accessible by the public;

b: All information necessary for successfully filing complaints;

c: Tracking mechanisms to ensure all complaints received are reviewed and addressed within [one of ];

d: Acknowledgement of receipt of complaints, concerns, or questions from individuals within [the time period for acknowledging the receipt of complaints is defined;] ; and

e: Response to complaints, concerns, or questions from individuals within [the time period for responding to complaints is defined;].