PM-24 Data Integrity Board

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: AC-4, PM-19, PM-23, PT-2, PT-8

Control statement

Establish a Data Integrity Board to:

• a. Review proposals to conduct or participate in a matching program; and
• b. Conduct an annual review of all matching programs in which the agency has participated.

NIST discussion

A Data Integrity Board is the board of senior officials designated by the head of a federal agency and is responsible for, among other things, reviewing the agency’s proposals to conduct or participate in a matching program and conducting an annual review of all matching programs in which the agency has participated. As a general matter, a matching program is a computerized comparison of records from two or more automated PRIVACT systems of records or an automated system of records and automated records maintained by a non-federal agency (or agent thereof). A matching program either pertains to Federal benefit programs or Federal personnel or payroll records. At a minimum, the Data Integrity Board includes the Inspector General of the agency, if any, and the senior agency official for privacy.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-24

Determine if a Data Integrity Board is established;

• PM-24a. the Data Integrity Board reviews proposals to conduct or participate in a matching program;
• PM-24b. the Data Integrity Board conducts an annual review of all matching programs in which the agency has participated.

Examine: Privacy program plan; privacy program documents relating to the Data Integrity Board, including documents establishing the board, its charter of operations, and any plans and reports; computer matching agreements and notices; information sharing agreements; memoranda of understanding; records documenting annual reviews; governing requirements, including laws, executive orders, regulations, standards, and guidance.

Interview: members of the Data Integrity Board (e.g., the chief information officer, senior information security officer, senior agency official for privacy, and agency Inspector General).

Policy statement

• Where Organization name conducts or takes part in a matching program, the Senior leader shall establish a data integrity board. (PM-24)
• The board shall review each proposal to conduct or take part in a matching program before the organization commits to it. (PM-24a)
• The board shall review, each year, every matching program the organization took part in. (PM-24b)

Federal systems

The Privacy Act requires every agency that conducts or participates in a matching program to establish a Data Integrity Board, which reviews matching proposals and reviews all of the agency’s matching programs each year (5 U.S.C. § 552a(u)).

• The data integrity board shall be established, staffed and run as 5 U.S.C. § 552a(u) requires. (PM-24)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-24 asks you to establish a data integrity board. The board reviews proposals to conduct or take part in a matching program (a), and reviews every matching program the organization took part in each year (b). PM-24 is in the SP 800-53B Privacy baseline.

NIST’s PM-24 discussion describes a matching program as a computerized comparison of records from two or more automated Privacy Act systems of records, or of such a system with a non-federal agency’s automated records. A matching program pertains to federal benefit programs or to federal personnel or payroll records. The board is made up of senior officials the agency head designates, and at a minimum includes the inspector general, if any, and the senior agency official for privacy.

The term and the duty come from the U.S. Privacy Act, so PM-24 applies to organizations that run or take part in matching programs. The Program Management policy says to keep the heading and record the decision in the program plan if the organization runs none. The steps for each matching program, including the board’s approval before it starts, are in PT-8 and the PII Processing and Transparency policy.

Common implementations. The PM-24 clause has the senior leader establish the board where the organization conducts or takes part in a matching program. A charter that would pass an assessment states:

• The members, by role, including the inspector general and the senior privacy official, and the chair
• A secretary who keeps the board’s records
• How proposals and matching agreements reach the board, and the record of each decision (a)
• The calendar for the annual review of every matching program, and who prepares it (b)
• How the board reports its review to the senior leader and publishes it

The board’s records connect to other controls. Matching agreements and notices are posted on the privacy webpage (PM-20). The privacy impact assessment for each system in a match lists the match as a disclosure, and the accounting of disclosures (PM-21) records it.

Organization-defined parameters. PM-24 has none. Its clause leaves these choices open, with typical values your organization may set differently:

Choice	Typical value
Who establishes the board	The senior leader (the clause)
Who sits on it	The senior privacy official, the inspector general (if any, and not as chair), the general counsel, and the chief information officer
When the annual review is held (b)	At the end of each calendar year
Where the decision is recorded if the organization runs no matching programs	The program plan

Evidence assessors ask for.

• The document that establishes the board, with its members and chair
• Records of the board’s review and decision on each matching proposal and agreement (a)
• The last annual review of all matching programs, and how it was reported (b)
• The list of the organization’s matching programs, with their agreements and notices

Inheritance. PM-24 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system that takes part in a matching program does so under the board’s approval.

Common findings.

• Matching programs running with no board review, often because nobody recognized them as matching programs.
• A board whose membership lacks the inspector general or the senior privacy official.
• No annual review, or a review that lists programs without assessing them (b).
• Matching agreements renewed by staff after the board’s approval expired.

Enhancements. PM-24 has no enhancements.

Federal systems (as of October 2026). Every agency conducting or participating in a matching program “shall establish a Data Integrity Board” (5 U.S.C. § 552a(u)). The agency head designates its senior officials, including the official responsible for the Privacy Act and the inspector general, if any, who may not chair it. The board reviews, approves and maintains all written matching agreements, and reviews each year all matching programs the agency took part in. It also compiles an annual report for the agency head and OMB, available to the public on request. It does not approve an agreement without a cost-benefit analysis showing the program is likely to be cost effective, unless one of the statutory exceptions applies, under (u)(4).

OMB Circular A-108 (December 2016), section 5.b, identifies the SAOP as a member. Section 14 has each agency’s board review the year’s matching programs at the end of each calendar year. The report goes to OMB by June 1 and is posted at www.[agency].gov/privacy, listing the members and each program’s compliance with its agreement.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy