Navigate

CCI-004444

CCI-004444 Definition

Implement response to complaints, concerns, or questions from individuals within an organization-defined time period.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if the complaint management process includes responding to complaints, concerns, or questions from individuals within [PM-26_ODP[04]; the time period for responding to complaints is defined].

Validation Procedures

Examine: [SELECT FROM: Privacy program plan; procedures addressing complaint management; complaint documentation; procedures addressing the reviews of complaints; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with privacy program responsibilities; organizational personnel with privacy responsibilities]. Test: [SELECT FROM: Organizational processes for complaint management; mechanisms supporting complaint management; tools used by the public to submit complaints, concerns, and questions (e.g., telephone, hotline, email, or web-based forms].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004444.

Control	Description
PM-26	Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes: a: Mechanisms that are easy to use and readily accessible by the public; b: All information necessary for successfully filing complaints; c: Tracking mechanisms to ensure all complaints received are reviewed and addressed within [one of ]; d: Acknowledgement of receipt of complaints, concerns, or questions from individuals within [the time period for acknowledging the receipt of complaints is defined;] ; and e: Response to complaints, concerns, or questions from individuals within [the time period for responding to complaints is defined;].

Control

Description

PM-26

Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes:

a: Mechanisms that are easy to use and readily accessible by the public;

b: All information necessary for successfully filing complaints;

c: Tracking mechanisms to ensure all complaints received are reviewed and addressed within [one of ];

d: Acknowledgement of receipt of complaints, concerns, or questions from individuals within [the time period for acknowledging the receipt of complaints is defined;] ; and

e: Response to complaints, concerns, or questions from individuals within [the time period for responding to complaints is defined;].