CCI-004590

Review all Privacy Act exemptions claimed for the system of records at organization-defined frequency to ensure that they are accurately described in the system of records notice.

Implementation Guidance

Determine if: - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they remain appropriate and necessary in accordance with law. - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they have been promulgated as regulations. - all Privacy Act exemptions claimed for the system of records are reviewed [PT-06(02)_ODP; the frequency at which to review all Privacy Act exemptions claimed for the system of records is defined] to ensure that they are accurately described in the system of records notice.

Validation Procedures

Examine: [SELECT FROM: Personally identifiable information processing and transparency policy and procedures; privacy notice; Privacy Act system of records; Privacy Act exemptions; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for Privacy Act system of records maintenance].

The controls below (if any) were marked by NIST as being related to CCI-004590.