PM-20 Dissemination of Privacy Program Information

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	1 (1 in a baseline)

Related controls: AC-3, PM-19, PT-5, PT-6, PT-7, RA-8

Control statement

Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that:

• a. Ensures that the public has access to information about organizational privacy activities and can communicate with its senior agency official for privacy;
• b. Ensures that organizational privacy practices and reports are publicly available; and
• c. Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

NIST discussion

For federal agencies, the webpage is located at www.[agency].gov/privacy. Federal agencies include public privacy impact assessments, system of records notices, computer matching notices and agreements, PRIVACT exemption and implementation rules, privacy reports, privacy policies, instructions for individuals making an access or amendment request, email addresses for questions/complaints, blogs, and periodic publications.

Control enhancements

PM-20(1) Privacy Policies on Websites, Applications, and Digital Services

Baselines: Privacy

Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that:

• (a) Are written in plain language and organized in a way that is easy to understand and navigate;
• (b) Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and
• (c) Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes.

Discussion and assessment objectives for PM-20(1)

Organizations post privacy policies on all external-facing websites, mobile applications, and other digital services. Organizations post a link to the relevant privacy policy on any known, major entry points to the website, application, or digital service. In addition, organizations provide a link to the privacy policy on any webpage that collects personally identifiable information. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that require the provision of specific information to the public. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.

Determine if:

• PM-20(01)[01] privacy policies are developed and posted on all external-facing websites;
• PM-20(01)[02] privacy policies are developed and posted on all mobile applications;
• PM-20(01)[03] privacy policies are developed and posted on all other digital services;
• PM-20(01)(a)
  • PM-20(01)(a)[01] the privacy policies are written in plain language;
  • PM-20(01)(a)[02] the privacy policies are organized in a way that is easy to understand and navigate;
• PM-20(01)(b)
  • PM-20(01)(b)[01] the privacy policies provide the information needed by the public to make an informed decision about whether to interact with the organization;
  • PM-20(01)(b)[02] the privacy policies provide the information needed by the public to make an informed decision about how to interact with the organization;
• PM-20(01)(c)
  • PM-20(01)(c)[01] the privacy policies are updated whenever the organization makes a substantive change to the practices it describes;
  • PM-20(01)(c)[02] the privacy policies include a time/date stamp to inform the public of the date of the most recent changes.

Examine: Privacy program plan; privacy policies on the agency website, mobile applications, and/or other digital services.

Interview: Organizational personnel with privacy program information dissemination responsibilities; organizational personnel with privacy responsibilities.

Test: Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing; organizational procedures and practices for disseminating privacy program information; mechanisms supporting the dissemination of privacy program information.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-20

Determine if:

• PM-20[01] a central resource webpage is maintained on the organization’s principal public website;
• PM-20[02] the webpage serves as a central source of information about the organization’s privacy program;
• PM-20a.
  • PM-20a.[01] the webpage ensures that the public has access to information about organizational privacy activities;
  • PM-20a.[02] the webpage ensures that the public can communicate with its senior agency official for privacy;
• PM-20b.
  • PM-20b.[01] the webpage ensures that organizational privacy practices are publicly available;
  • PM-20b.[02] the webpage ensures that organizational privacy reports are publicly available;
• PM-20c. the webpage employs publicly facing email addresses and/or phone numbers to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

Examine: Public website; publicly posted privacy program documents, including policies, procedures, plans, and reports; position description of the senior agency official for privacy; public privacy notices, including Federal Register notices; privacy impact assessments; privacy risk assessments; Privacy Act statements and system of records notices; computer matching agreements and notices; other relevant documents or records.

Interview: Organizational personnel with privacy program information dissemination responsibilities; organizational personnel with privacy responsibilities.

Test: Location, access, availability, and functionality of privacy resource webpage.

Policy statement

• The Senior privacy official shall maintain a privacy webpage on the organization’s principal public website as the central source of information about the privacy program. (PM-20)
• The page shall give the public information about the organization’s privacy activities and a way to contact the Senior privacy official. (PM-20a)
• The page shall make the organization’s privacy practices and reports publicly available. (PM-20b)
• The page shall list a public email address or phone line for feedback and questions to the privacy office. (PM-20c)

Federal systems

OMB M-23-22, Delivering a Digital-First Public Experience (September 2023), requires each agency’s privacy program page to be located at www.[agency].gov/privacy, as of September 2026.

• The privacy webpage shall be located at the address M-23-22 requires, www.[agency].gov/privacy. (PM-20)

PM-20(1) Privacy policies on websites, applications and digital services

• The Senior privacy official shall ensure a privacy policy is posted on every external-facing website, mobile application and other digital service. (PM-20(1))
• Each privacy policy shall be written in plain language and organized so that it is easy to understand and navigate. (PM-20(1)(a))
• Each privacy policy shall give the public the information it needs to decide whether and how to interact with the organization. (PM-20(1)(b))
• Each privacy policy shall be updated whenever the organization makes a substantive change to the practices it describes, and shall show the date of the latest change. (PM-20(1)(c))

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-20 asks for one privacy webpage on your principal public website, the central source of information about the privacy program. It tells the public about your privacy activities and how to reach the senior privacy official (a), publishes your privacy practices and reports (b), and gives a public email address or phone line for questions and feedback (c). PM-20 is in the SP 800-53B Privacy baseline.

NIST’s PM-20 discussion lists what federal agencies post: public privacy impact assessments, system of records notices, matching notices and agreements, Privacy Act exemption and implementation rules, and privacy reports. It adds privacy policies, instructions for access and amendment requests, email addresses for questions and complaints, and blogs and periodic publications. A non-federal organization posts its equivalents: its privacy notice, published assessments, reports and contact details.

Common implementations. The Program Management policy gives the page to the senior privacy official. The privacy notice is written to be published there; its register lists every notice and where it is posted. Published privacy impact assessments (RA-8) are linked from the page.

A page that would pass an assessment usually has:

• The privacy notice, or links to each notice the organization publishes (PT-5)
• The name or title of the senior privacy official, and how to contact the privacy office (a)
• Published privacy impact assessments, privacy reports and privacy policies (b)
• How to ask for access to or correction of personal information (PM-22)
• A monitored email address or phone line for questions and complaints (c)
• A last-reviewed date, and an owner who checks the links

Treat the contact channel as a process, not just an address. Route messages to the privacy office, track each one to a response, and send any that report a breach into incident handling (IR-6).

Organization-defined parameters. PM-20 has none. Its clause leaves these choices open, with typical values your organization may set differently:

Choice	Typical value
Where the page lives	One page on the principal public website, such as /privacy, linked from every page’s footer
Who keeps it current	The senior privacy official (the clause), with the web team
How often it is reviewed	Quarterly, and whenever a notice, assessment or report is published or changed
Public contact channel (c)	A monitored privacy email address, with a phone line where the organization serves the public by phone

Evidence assessors ask for.

• The live page, and a test that its links and contact channel work
• The list of practices and reports the page should carry, checked against what it does
• Records of questions and complaints received through the channel, and their responses (c)
• The record of the last review of the page

Inheritance. PM-20 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system’s notices, assessments and reports are published through the one page.

Common findings.

• A privacy page that holds only the website’s own privacy policy, with nothing about the program.
• Broken links to assessments or notices that have moved.
• A contact address nobody monitors, or a web form with no tracking.
• Reports and notices on the page that are years out of date.

Enhancements in the Privacy baseline. PM-20(1) asks for a privacy policy on every external-facing website, mobile application and other digital service. Each policy is in plain language and easy to navigate (a), gives the public what it needs to decide whether and how to interact with the organization (b), and is updated after each substantive change, with a date stamp (c). NIST’s discussion adds that you link the policy from known major entry points and from every page that collects personally identifiable information.

The PM-20(1) clause gives this to the senior privacy official. Part 1 of the privacy notice is written to serve as the policy, with a “last updated” date for (c). Keep an inventory of external-facing sites, applications and services, and check each against the register in the privacy notice. A typical review is part of the page review above, and each release that changes how a service handles personal information triggers an update.

Federal systems (as of October 2026). OMB M-23-22, Delivering a Digital-First Public Experience (September 22, 2023), section III.A.9.a, requires a Privacy Program Page at [agency].gov/privacy. At a minimum it carries system of records notices, matching notices and agreements, Privacy Act exemptions and implementation rules, and instructions for a Privacy Act request. It also lists privacy impact assessments, privacy policies and privacy reports, with contact information for questions and complaints and for the SAOP’s office. OMB Circular A-108, section 15, sets the Privacy Act items, and OMB’s FY 2026 SAOP FISMA Reporting Metrics (August 2026) ask about each one.

For PM-20(1), the same section of M-23-22 requires privacy policies on all public-facing websites and digital services, linked from major entry points and from every page that collects PII. Each must be in plain language, updated after substantive changes with a time-and-date stamp, and link to the Privacy Program Page. Its footnote 55 excludes internal activities such as intranets. OMB Circular A-130, main body section 5.f(1)(j), requires agencies to “maintain and post privacy policies on all agency websites, mobile applications, and other digital services.”

Artifacts

• Privacy Notice
• Program Management Decision Worksheet
• Program Management Policy