PM-27 Privacy Reporting

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: IR-9, PM-19

Control statement

• a. Develop [Assignment: organization-defined privacy reports] and disseminate to:
  • 1. [Assignment: organization-defined oversight bodies] to demonstrate accountability with statutory, regulatory, and policy privacy mandates; and
  • 2. [Assignment: organization-defined officials] and other personnel with responsibility for monitoring privacy program compliance; and
• b. Review and update privacy reports [Assignment: organization-defined frequency].

NIST discussion

Through internal and external reporting, organizations promote accountability and transparency in organizational privacy operations. Reporting can also help organizations to determine progress in meeting privacy compliance requirements and privacy controls, compare performance across the federal government, discover vulnerabilities, identify gaps in policy and implementation, and identify models for success. For federal agencies, privacy reports include annual senior agency official for privacy reports to OMB, reports to Congress required by Implementing Regulations of the 9/11 Commission Act, and other public reports required by law, regulation, or policy, including internal policies of organizations. The senior agency official for privacy consults with legal counsel, where appropriate, to ensure that organizations meet all applicable privacy reporting requirements.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-27

Determine if:

• PM-27a. [Assignment: organization-defined privacy reports] are developed;
  • PM-27a.01 the privacy reports are disseminated to [Assignment: organization-defined oversight bodies] to demonstrate accountability with statutory, regulatory, and policy privacy mandates;
  • PM-27a.02
    • PM-27a.02[01] the privacy reports are disseminated to [Assignment: organization-defined officials];
    • PM-27a.02[02] the privacy reports are disseminated to other personnel responsible for monitoring privacy program compliance;
• PM-27b. the privacy reports are reviewed and updated [Assignment: organization-defined frequency].

Examine: Privacy program plan; internal and external privacy reports; privacy program plan; annual senior agency official for privacy reports to OMB; reports to Congress required by law, regulation, or policy, including internal policies; records documenting the dissemination of reports to oversight bodies and officials responsible for monitoring privacy program compliance; records of review and updates of privacy reports..

Interview: Organizational personnel with privacy program responsibilities; organizational personnel with privacy responsibilities; legal counsel..

Policy statement

• The Senior privacy official shall develop Fill in: privacy reports Typical: an annual privacy program report, summaries of privacy impact assessments, and breach reports. (PM-27a)
• The Senior privacy official shall disseminate the reports to Fill in: privacy oversight bodies Typical: the board of directors or its audit committee, and regulators where law requires, to demonstrate accountability with statutory, regulatory and policy privacy mandates. (PM-27a.1)
• The Senior privacy official shall disseminate the reports to Fill in: officials responsible for monitoring privacy program compliance Typical: the senior leader, the chief information security officer and general counsel and other personnel responsible for monitoring privacy program compliance. (PM-27a.2)
• The Senior privacy official shall review and update the reports Fill in: the frequency for reviewing and updating privacy reports Typical: annually. (PM-27b)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-27 asks you to develop privacy reports and send them to oversight bodies, to show accountability for statutory, regulatory and policy privacy mandates (a.1). You also send them to the officials and other staff who monitor privacy program compliance (a.2), and you review and update the reports at a set frequency (b). PM-27 is in the SP 800-53B Privacy baseline.

NIST’s PM-27 discussion says internal and external reporting promotes accountability and transparency. It helps the organization judge progress against privacy requirements and controls, compare performance, discover vulnerabilities, find gaps in policy and implementation, and find models for success. The senior agency official for privacy consults legal counsel, where appropriate, to make sure the organization meets every privacy reporting requirement that applies. Reports often draw on the privacy program’s other records, such as breach reports (IR-8(1)), the accounting of disclosures (PM-21) and complaint records (PM-26).

Common implementations. The Program Management policy has the senior privacy official develop, send and update the reports. Most organizations keep a reporting calendar with one row per report:

Column	What it holds
Report	Its name, such as the annual privacy program report
Source	The law, regulation, contract or internal policy that requires it
Recipients	The oversight bodies (a.1) and officials (a.2) it goes to
Due date and owner	When it is due and who prepares it
Data sources	The records it draws on

An annual privacy program report that would pass an assessment covers the privacy impact assessments completed, the privacy notices issued or changed, breaches and their handling, complaints and response times, privacy training completion, privacy control assessment results and open privacy weaknesses. Each figure traces to a record. The quarterly breach status report in the incident handling playbook (section 5.8) and the privacy status reports under PM-31 feed it.

Organization-defined parameters. From templates/policy/pm/. Typical values, which your organization may set differently:

Parameter	Typical value
Privacy reports (a)	An annual privacy program report, summaries of privacy impact assessments, and breach reports
Oversight bodies (a.1)	The board of directors or its audit committee, and regulators where law requires
Officials who monitor privacy compliance (a.2)	The senior leader, the chief information security officer and general counsel
Report review and update frequency (b)	Annually

Evidence assessors ask for.

• The reporting calendar, and legal counsel’s review of the reporting requirements that apply
• Copies of the reports for the last period (a)
• Records showing each report reached its oversight bodies and officials, with dates (a.1, a.2)
• The record of the last review and update of each report (b)
• The data behind a sample of reported figures

Inheritance. PM-27 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system supplies the data the reports need, such as its privacy impact assessment and its breach records.

Common findings.

• No list of reporting obligations, so a report a regulator or contract requires is missed.
• Reports that stay inside the privacy office and never reach an oversight body (a.1).
• Figures that cannot be traced to records.
• The same report sent each year without review, still naming offices or systems that no longer exist (b).

Enhancements. PM-27 has no enhancements.

Federal systems (as of October 2026). NIST’s discussion names, for federal agencies, the annual senior agency official for privacy reports to OMB and reports to Congress required by the Implementing Recommendations of the 9/11 Commission Act. OMB’s FY 2026 SAOP FISMA Reporting Metrics (August 2026) cover October 1, 2025 to September 30, 2026; SAOPs submit their answers and the listed documents, among them the privacy program plan, the breach response plan and the privacy continuous monitoring strategy, through CyberScope by October 30, 2026. OMB Circular A-108, section 14, has the Data Integrity Board of each agency that took part in a matching program during the year review that year’s matching programs and report to the agency head and to OMB, by June 1, with the report posted on the agency’s privacy page. OMB M-23-22, section III.A.9.a, says agencies must list and link all publicly available agency reports on privacy on that page, for example annual matching reports and Section 803 reports under the 9/11 Commission Act.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy