CCI-004645

Conduct privacy impact assessments for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information.

Implementation Guidance

Determine if privacy impact assessments are conducted for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information.

Validation Procedures

Examine: [SELECT FROM: Risk assessment policy; security and privacy risk assessment reports; acquisitions documents; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with assessment and auditing responsibilities; system/network administrators; system developers; program managers; legal counsel; organizational personnel with security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for assessments and audits; mechanisms/tools supporting and/or implementing assessments and auditing].

The controls below (if any) were marked by NIST as being related to CCI-004645.