CCI-004448

Disseminate privacy reports to organization-defined oversight bodies to demonstrate accountability with statutory, regulatory, and policy privacy program mandates.

Implementation Guidance

Determine if the privacy reports are disseminated to [PM-27_ODP[02]; privacy oversight bodies are defined] to demonstrate accountability with statutory, regulatory, and policy privacy mandates.

Validation Procedures

Examine: [SELECT FROM: Privacy program plan; internal and external privacy reports; privacy program plan; annual senior agency official for privacy reports to OMB; reports to Congress required by law, regulation, or policy, including internal policies; records documenting the dissemination of reports to oversight bodies and officials responsible for monitoring privacy program compliance; records of review and updates of privacy reports.]. Interview: [SELECT FROM: Organizational personnel with privacy program responsibilities; organizational personnel with privacy responsibilities; legal counsel.].

The controls below (if any) were marked by NIST as being related to CCI-004448.