PM-26 Complaint Management

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: IR-7, IR-9, PM-22, SI-18

Control statement

Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes:

• a. Mechanisms that are easy to use and readily accessible by the public;
• b. All information necessary for successfully filing complaints;
• c. Tracking mechanisms to ensure all complaints received are reviewed and addressed within [Assignment: organization-defined time period];
• d. Acknowledgement of receipt of complaints, concerns, or questions from individuals within [Assignment: organization-defined time period] ; and
• e. Response to complaints, concerns, or questions from individuals within [Assignment: organization-defined time period].

NIST discussion

Complaints, concerns, and questions from individuals can serve as valuable sources of input to organizations and ultimately improve operational models, uses of technology, data collection practices, and controls. Mechanisms that can be used by the public include telephone hotline, email, or web-based forms. The information necessary for successfully filing complaints includes contact information for the senior agency official for privacy or other official designated to receive complaints. Privacy complaints may also include personally identifiable information which is handled in accordance with relevant policies and processes.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-26

Determine if:

• PM-26[01] a process for receiving complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;
• PM-26[02] a process for responding to complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;
• PM-26a.
  • PM-26a.[01] the complaint management process includes mechanisms that are easy to use by the public;
  • PM-26a.[02] the complaint management process includes mechanisms that are readily accessible by the public;
• PM-26b. the complaint management process includes all information necessary for successfully filing complaints;
• PM-26c.
  • PM-26c.[01] the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within [Assignment: organization-defined time period];
  • PM-26c.[02] the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within [Assignment: organization-defined time period];
• PM-26d. the complaint management process includes acknowledging the receipt of complaints, concerns, or questions from individuals within [Assignment: organization-defined time period];
• PM-26e. the complaint management process includes responding to complaints, concerns, or questions from individuals within [Assignment: organization-defined time period].

Examine: Privacy program plan; procedures addressing complaint management; complaint documentation; procedures addressing the reviews of complaints; other relevant documents or records.

Interview: Organizational personnel with privacy program responsibilities; organizational personnel with privacy responsibilities.

Test: Organizational processes for complaint management; mechanisms supporting complaint management; tools used by the public to submit complaints, concerns, and questions (e.g., telephone, hotline, email, or web-based forms.

Policy statement

• The Senior privacy official shall implement a process for receiving and responding to complaints, concerns and questions from individuals about the organization’s security and privacy practices. (PM-26)
• The process shall offer ways to file that are easy to use and readily accessible to the public. (PM-26a)
• The process shall tell individuals all the information they need to file a complaint successfully. (PM-26b)
• The process shall track each complaint so that it is reviewed within Fill in: the time period in which complaints (including concerns or questions) from individuals are to be reviewed Typical: 5 business days and addressed within Fill in: the time period in which complaints (including concerns or questions) from individuals are to be addressed Typical: 30 days. (PM-26c)
• The Senior privacy official shall acknowledge receipt of each complaint, concern or question within Fill in: the time period for acknowledging the receipt of complaints Typical: 3 business days. (PM-26d)
• The Senior privacy official shall respond to each complaint, concern or question within Fill in: the time period for responding to complaints Typical: 30 days. (PM-26e)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-26 asks for a process for receiving and responding to complaints, concerns and questions from individuals about your security and privacy practices. The process offers ways to file that are easy to use and readily accessible to the public (a), and gives all the information needed to file a complaint (b). It tracks every complaint so that it is reviewed and addressed within set times (c), and acknowledges (d) and responds (e) within set times. PM-26 is in the SP 800-53B Privacy baseline.

NIST’s PM-26 discussion says complaints, concerns and questions are valuable input that can improve operational models, uses of technology, data collection practices and controls. Public mechanisms include a telephone hotline, email and web forms. The information needed to file includes contact information for the senior agency official for privacy or another official designated to receive complaints. Complaints may themselves contain personally identifiable information, which is handled under the relevant policies.

A complaint can be the first sign of something another control handles. A report that someone’s data was exposed may be an incident or a breach to report under IR-6, and a spill of information is handled under IR-9. A request to correct records goes to the quality and correction processes (PM-22, SI-18). A report of a vulnerability in a public system goes to the public disclosure program, where there is one (RA-5(11)).

Common implementations. The Program Management policy has the senior privacy official run the process. The privacy notice gives the public contact for questions, requests and complaints, and each system’s privacy impact assessment records how individuals raise a concern (section 8). The privacy program page (PM-20) is the usual place to publish the channels.

A process that would pass an assessment has:

• At least two channels, such as a web form and an email address or phone number, both monitored by named staff
• A public page that says what to include, what happens next and how long each step takes
• One log for every complaint, concern and question: date received, channel, category, owner, and the dates acknowledged, reviewed, addressed and answered
• Categories that route each item: a possible incident or breach to the incident response team at once, a correction request to the correction process, and a security concern to the security office
• A monthly report of open items and times to the senior privacy official, and a yearly look at trends that feeds changes to practices and controls

Organization-defined parameters. From templates/policy/pm/. Typical values, which your organization may set differently:

Parameter	Typical value
Time to review each complaint (c)	5 business days
Time to address each complaint (c)	30 days
Time to acknowledge receipt (d)	3 business days
Time to respond (e)	30 days

Count the business-day periods from the day the complaint arrives in any channel, not the day someone first reads it. If a law sets a shorter time for a kind of request, the law’s time applies to that request.

Evidence assessors ask for.

• The public page, form or notice that shows the channels and the information needed to file (a, b)
• The written procedure, with the four times
• The tracking log, and a sample of entries showing each time met, or the reason it was missed (c, d, e)
• Examples of acknowledgements and responses
• Reports of complaint trends, and changes made because of them

Inheritance. PM-26 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Systems that interact with the public point to the organization’s channels rather than running their own.

Common findings.

• A published email address that nobody monitors.
• Complaints handled in personal inboxes, with no log to show the times were met (c).
• Complaints acknowledged but never answered (e).
• A complaint describing a possible breach that never reached the incident response team.
• Channels for privacy complaints only, with no way to raise a security concern.
• Complaint records, which hold personal information, kept with no access limits or retention rule.

Enhancements. PM-26 has no enhancements.

Federal systems (as of October 2026). OMB Circular A-130, Appendix II, section 3.f, says agencies “should also establish procedures to receive and address individuals’ privacy-related complaints and inquiries”; OMB states that the Fair Information Practice Principles in that section are principles, not OMB requirements. OMB M-23-22, section III.A.9.a, says the agency’s Privacy Program Page must provide appropriate contact information for individuals who wish to submit a privacy-related question or complaint, and OMB’s FY 2026 SAOP FISMA Reporting Metrics (August 2026, question 14j) ask whether it does. A request to amend a record in a system of records is a separate Privacy Act process: the agency acknowledges it in writing within 10 days, excluding Saturdays, Sundays and legal public holidays (5 U.S.C. § 552a(d)(2)).

Artifacts

• Program Management Decision Worksheet
• Program Management Policy