PT-8 Computer Matching Requirements

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: PM-24

Control statement

When a system or organization processes information for the purpose of conducting a matching program:

• a. Obtain approval from the Data Integrity Board to conduct the matching program;
• b. Develop and enter into a computer matching agreement;
• c. Publish a matching notice in the Federal Register;
• d. Independently verify the information produced by the matching program before taking adverse action against an individual, if required; and
• e. Provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual.

NIST discussion

The PRIVACT establishes requirements for federal and non-federal agencies if they engage in a matching program. In general, a matching program is a computerized comparison of records from two or more automated PRIVACT systems of records or an automated system of records and automated records maintained by a non-federal agency (or agent thereof). A matching program either pertains to federal benefit programs or federal personnel or payroll records. A federal benefit match is performed to determine or verify eligibility for payments under federal benefit programs or to recoup payments or delinquent debts under federal benefit programs. A matching program involves not just the matching activity itself but also the investigative follow-up and ultimate action, if any.

Assessment objectives (SP 800-53A)

Objectives and methods for PT-8

Determine if:

• PT-08a. approval to conduct the matching program is obtained from the Data Integrity Board when a system or organization processes information for the purpose of conducting a matching program;
• PT-08b.
  • PT-08b.[01] a computer matching agreement is developed when a system or organization processes information for the purpose of conducting a matching program;
  • PT-08b.[02] a computer matching agreement is entered into when a system or organization processes information for the purpose of conducting a matching program;
• PT-08c. a matching notice is published in the Federal Register when a system or organization processes information for the purpose of conducting a matching program;
• PT-08d. the information produced by the matching program is independently verified before taking adverse action against an individual, if required, when a system or organization processes information for the purpose of conducting a matching program;
• PT-08e.
  • PT-08e.[01] individuals are provided with notice when a system or organization processes information for the purpose of conducting a matching program;
  • PT-08e.[02] individuals are provided with an opportunity to contest the findings before adverse action is taken against them when a system or organization processes information for the purpose of conducting a matching program.

Examine: Personally identifiable information processing and transparency policy and procedures; privacy notice; Privacy Act system of records; Federal Register notices; Data Integrity Board determinations; contracts; information sharing agreements; memoranda of understanding; governing requirements; privacy plan; other relevant documents or records.

Interview: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for supporting and/or implementing personally identifiable information processing; matching program.

Policy statement

• Where a system or the organization processes information to conduct a matching program, the Senior privacy official shall obtain the approval of the data integrity board before the program begins. (PT-8a)
• The Senior privacy official shall develop and enter into a computer matching agreement for each matching program. (PT-8b)
• The Senior privacy official shall publish a matching notice in the Federal Register for each matching program. (PT-8c)
• The System owner shall independently verify the information a matching program produces before any adverse action is taken against an individual, where verification is required. (PT-8d)
• The System owner shall give each individual notice and an opportunity to contest the findings before any adverse action is taken against them. (PT-8e)

Federal systems

The Privacy Act (5 U.S.C. § 552a) requires a written matching agreement stating, among other things, the purpose and legal authority, the justification and expected results, the records and data elements matched, and the verification, retention, security and redisclosure rules (subsection (o)(1)); the agreement takes effect 30 days after it is sent to the congressional committees, lasts no more than 18 months, and may be renewed once for up to one year (subsection (o)(2)); after that, the program continues only if it is re-established, with a new matching notice and report (OMB Circular A-108, section 8 and footnote 72). The data integrity board approves each agreement (subsection (u)(3)(A)). A matching notice is published in the Federal Register at least 30 days before the program is conducted (subsection (e)(12)), and OMB and Congress get advance notice (subsection (r)). No adverse action may follow until the information is independently verified, or the board makes the determination subsection (p)(1)(A)(ii) allows, and the individual has been notified and has had the period set by statute or regulation, or else 30 days, to respond (subsection (p)). OMB Circular A-108, sections 8 and 9, sets how matching notices are published and reported. As of October 2026.

• Each computer matching agreement shall contain every element 5 U.S.C. § 552a(o)(1) lists, and be sent to the congressional committees at least 30 days before it takes effect. (PT-8b)
• The data integrity board shall set each agreement’s term at no more than 18 months, and renew it no more than once, for up to one year, as 5 U.S.C. § 552a(o)(2)(D) and OMB Circular A-108, section 8, allow. (PT-8b)
• The Senior privacy official shall publish the matching notice at least 30 days before the matching program is conducted. (PT-8c)
• The System owner shall allow the individual the period set by statute or regulation, or else 30 days from the notice, to respond before taking adverse action. (PT-8e)

From the Personally Identifiable Information Processing and Transparency Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PT-8 applies when a system or organization processes information to conduct a matching program. Get the data integrity board’s approval (a), enter into a computer matching agreement (b), publish a matching notice in the Federal Register (c), independently verify what the match produces before taking adverse action against anyone, where required (d), and give individuals notice and a chance to contest the findings before adverse action (e). PT-8 is in the SP 800-53B Privacy baseline only.

NIST’s PT-8 discussion explains that the U.S. Privacy Act sets these requirements for federal and non-federal agencies that take part in a matching program. In general, a matching program is a computerized comparison of records from two or more automated Privacy Act systems of records, or of a system of records with automated records a non-federal agency keeps, that pertains to federal benefit programs or to federal personnel or payroll records. A benefit match determines or verifies eligibility for payments under a federal benefit program, or recoups payments or delinquent debts. The program covers not just the match but the investigative follow-up and any action taken.

Matching programs are run by federal agencies, often with state or local agencies as partners. Any other organization keeps the PT-8 heading and records that it runs none, as the PT-8 clause and the PT decision worksheet say. The data integrity board is the one PM-24 establishes; that page covers its membership and annual review.

Common implementations. The PT-8 clause of the PII Processing and Transparency policy gives approval, the agreement and the notice to the senior privacy official, and verification and notice to individuals to the system owner. In practice:

• A screening question that asks whether a planned comparison of records is a matching program, with legal counsel deciding close cases. The federal table of the privacy impact assessment asks it for each system, along with the agreement and notice; ask it in data-sharing reviews too
• A calendar of every matching agreement’s expiry date, so the board can renew or the program can be re-established in time
• Written verification steps for each program, and a template letter that states the findings and how to contest them
• A hold in the benefit or payment system that blocks adverse action until verification and the response period are complete

Organization-defined parameters. PT-8 has none. Its clause leaves these choices open, with typical values your organization may set differently:

Choice	Typical value
Who decides whether an activity is a matching program	The senior privacy official, with legal counsel
Who obtains board approval, agreements and notices (a to c)	The senior privacy official (the clause)
Who verifies results and notifies individuals (d, e)	The system owner of the program that would take the action (the clause)
Time allowed to respond before adverse action (e)	The period set by statute or regulation, or else 30 days from the notice (the clause’s federal block)
Where the decision is recorded if the organization runs no matching programs	The privacy plan, and the PT decision worksheet

Evidence assessors ask for.

• The list of the organization’s matching programs, with each agreement, its approval by the board and its expiry date
• The published matching notices, with their Federal Register citations
• For a sample of adverse actions that followed a match, the verification record, the notice sent to the individual and the dates
• The board’s records of renewals and of its annual review

Inheritance. PT-8 is carried out by the agency for each matching program, under the board PM-24 establishes. The systems that take part inherit the agreement and the notice, and enforce verification and notice before adverse action.

Common findings.

• A data exchange that meets the definition of a matching program, run without an agreement or notice because it was set up as an ordinary interface.
• Agreements expired, or renewed more than once, while the match kept running.
• Adverse action taken on match results with no independent verification or no notice to the individual.
• No list of matching programs, so nobody can show the board reviewed them all.

Enhancements. PT-8 has no enhancements.

Federal systems (as of October 2026). The Privacy Act (5 U.S.C. § 552a) defines a matching program in subsection (a)(8), including what it excludes, such as matches that produce only aggregate statistics or that support research whose data may not be used to make decisions about specific individuals. Subsection (o)(1) bars disclosing records for a matching program except under a written agreement and lists what the agreement must specify. Under (o)(2), the agreement goes to the congressional committees and is available to the public on request, takes effect 30 days after it is sent, and runs for no more than 18 months. Within 3 months before it expires, the board may renew it for not more than one additional year if the program is unchanged and each party certifies compliance. Subsection (p) bars adverse action until the information is independently verified (or the board makes the determination (p)(1)(A)(ii) allows), the individual has been notified of the findings and the chance to contest them, and the response period set by statute or regulation, or else 30 days, has passed. Under (p)(3), an agency may act sooner if public health or public safety may be adversely affected or significantly threatened during the notice period. Subsection (q) bars a source agency from disclosing records, or renewing an agreement, when it has reason to believe the recipient is not meeting (p) or the agreement. Subsection (e)(12) requires the matching notice in the Federal Register at least 30 days before the program is conducted, and subsection (r) requires advance notice to OMB and the congressional committees.

OMB Circular A-108, section 8, sets how matching notices are drafted and when: at least 30 days before a program is established, re-established or significantly changed, with a notice of re-establishment published at least 30 days before the existing agreement expires. A one-year renewal by the board needs no notice. Section 9 requires the report to OMB and Congress at least 30 days before the notice goes to the Federal Register, and at least 60 days before the agreement expires for a re-established program, with the board-approved agreement attached.

For matching through Treasury’s Do Not Pay Working System, OMB M-25-32 (August 20, 2025), Appendix II, sets criteria for a class of matching programs eligible for a four-year waiver of the subsection (o) matching agreement requirement. Treasury’s Bureau of the Fiscal Service published notice of the waiver (90 FR 43729, September 10, 2025), effective through September 10, 2029. The waiver replaces only the agreement. An agency using it signs a data sharing agreement with Treasury before the match and still reports the program to OMB and Congress. It still publishes a matching notice, saying a waiver was granted, and waits out the 30-day comment period. It still verifies results and gives notice under subsection (p), and runs annual role-based Privacy Act training for the officials who conduct the program. M-25-32 asks agencies to keep observing existing matching agreements until they expire.

Artifacts

• Personally Identifiable Information Processing and Transparency Decision Worksheet
• Personally Identifiable Information Processing and Transparency Policy
• Privacy Impact Assessment