# Information Security and Privacy Policy

**Template version:** 1.0.0 · **Baseline:** Privacy · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/consolidated/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for Information Security and Privacy, and who is accountable for meeting those requirements. (XX-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (XX-1a.1(a))

## Control families

This policy is the policy of each control family below, in place of separate family policies. Its shared sections meet the first control of each family, the -1 control, which asks for a policy and procedures; a reference such as (XX-1a.1(a)) cites that item of the -1 control of every family below. PM-1 asks for different elements, so the Program Management part opens with its own statements for it. Each family's statements are in its own part under Policy statements.

| Family | Policy control | Accountable role |
| --- | --- | --- |
| Access Control (AC) | AC-1 | [Chief Information Security Officer] |
| Awareness and Training (AT) | AT-1 | [Chief Information Security Officer] |
| Audit and Accountability (AU) | AU-1 | [Chief Information Security Officer] |
| Assessment, Authorization, and Monitoring (CA) | CA-1 | [Chief Information Security Officer] |
| Configuration Management (CM) | CM-1 | [Chief Information Security Officer] |
| Incident Response (IR) | IR-1 | [Chief Information Security Officer] |
| Media Protection (MP) | MP-1 | [Chief Information Security Officer] |
| Physical and Environmental Protection (PE) | PE-1 | [Facilities manager] |
| Planning (PL) | PL-1 | [Chief Information Security Officer] |
| Program Management (PM) | PM-1 | [Chief Information Security Officer] |
| Personnel Security (PS) | PS-1 | [Chief Information Security Officer] |
| Personally Identifiable Information Processing and Transparency (PT) | PT-1 | [Senior privacy official] |
| Risk Assessment (RA) | RA-1 | [Chief Information Security Officer] |
| System and Services Acquisition (SA) | SA-1 | [Chief Information Security Officer] |
| System and Communications Protection (SC) | SC-1 | [Chief Information Security Officer] |
| System and Information Integrity (SI) | SI-1 | [Chief Information Security Officer] |

- Where the table names a role other than the [Chief Information Security Officer] for a family, that role shall be accountable for the family's part of this policy and shall approve exceptions to it, in coordination with the [Chief Information Security Officer]. (XX-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (XX-1a.1(a))
- The [Fill in: an official to manage the information security and privacy policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (XX-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (XX-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (XX-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (XX-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (XX-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (XX-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (XX-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (XX-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (XX-1a.1(a))

## Procedures

The [Fill in: an official to manage the information security and privacy policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (XX-1a.2)

## Dissemination

- The [Fill in: an official to manage the information security and privacy policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the information security and privacy policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (XX-1a)
- The [Fill in: an official to manage the information security and privacy policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the information security and privacy procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (XX-1a)

## Policy statements

### Access Control (AC)

#### Individual access (AC-3(14))

- For a system that processes personally identifiable information, the [System owner] shall provide [Fill in: mechanisms enabling individuals to have access to elements of their personally identifiable information. Typical: a request process described in the privacy notice, with identity verification before any information is released, and a self-service page where the system offers one] to enable individuals to have access to the following elements of their personally identifiable information: [Fill in: elements of personally identifiable information to which individuals have access. Typical: all personally identifiable information about the individual that the system holds, except elements a law, regulation or legal hold exempts from access, as the senior privacy official and legal counsel determine]. (AC-3(14))
- The [Senior privacy official], with legal counsel, shall approve the access mechanisms and any limits on the elements available, and the [System owner] shall record them in the privacy impact assessment. (AC-3(14))
- The [System owner] shall ensure the identity of each requester, or the authority of their designated representative, is verified at an assurance level suited to the sensitivity of the information before any information is released. (AC-3(14))
- The [Senior privacy official] shall ensure each access request is answered, and that a refusal or a partial release is given in writing with the reason and how to appeal. (AC-3(14))

##### Federal systems

The Privacy Act requires each agency that maintains a system of records, upon request by any individual to gain access to their record or to any information about them in the system, to permit the individual, and upon request a person of their own choosing to accompany them, to review the record and have a copy made of all or any portion of it in a form comprehensible to them; the agency may require a written statement authorizing discussion of the record in the accompanying person's presence ([5 U.S.C. § 552a(d)(1)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). Each system of records notice must describe the agency procedures by which an individual can learn how to gain access to a record about them and how to contest its content (§ 552a(e)(4)(H)). The agency's Privacy Act rules must establish procedures for notifying individuals whether a system of records contains a record about them, define reasonable times, places and requirements for identifying requesters, establish procedures for disclosure to individuals, and set any fees for copies, excluding the cost of search and review (§ 552a(f)). Nothing in the section allows access to information compiled in reasonable anticipation of a civil action or proceeding (§ 552a(d)(5)), and subsections (j) and (k) let an agency exempt some systems of records from the access provisions by rule. Text checked in the United States Code, 2024 edition, as of October 2026.

- For each system of records, the [Senior privacy official] shall ensure that individuals can review, and have a copy made of, their records in a form comprehensible to them, accompanied by a person of their choosing on request, as 5 U.S.C. § 552a(d)(1) requires, except for information § 552a(d)(5) excludes and systems the agency has exempted by rule under § 552a(j) or (k). (AC-3(14))
- The access mechanisms for each system of records shall follow the agency's Privacy Act rules under 5 U.S.C. § 552a(f), and its system of records notice shall describe them as § 552a(e)(4)(H) requires. (AC-3(14))

### Awareness and Training (AT)

#### Literacy training and awareness (AT-2)

- The [Chief Information Security Officer] shall provide security literacy training to all system users, including managers, senior executives and contractors, as part of initial training before they are given access, and [Fill in: the frequency at which to provide security literacy training to system users (including managers, senior executives, and contractors) after initial training. Typical: annually] thereafter. (AT-2a.1)
- The [Senior privacy official] shall provide privacy literacy training to all system users, including managers, senior executives and contractors, as part of initial training before they are given access, and [Fill in: the frequency at which to provide privacy literacy training to system users (including managers, senior executives, and contractors) after initial training. Typical: annually] thereafter. (AT-2a.1)
- The [Chief Information Security Officer] shall provide security literacy training when system changes require it, and following [Fill in: events that require security literacy training for system users. Typical: a significant system change, or an incident caused by user error]. (AT-2a.2)
- The [Senior privacy official] shall provide privacy literacy training when system changes require it, and following [Fill in: events that require privacy literacy training for system users. Typical: a significant change in how the organization processes personally identifiable information, or a privacy breach]. (AT-2a.2)
- The [Chief Information Security Officer] shall increase users' security and privacy awareness through [Fill in: techniques to be employed to increase the security and privacy awareness of system users. Typical: phishing simulations, short awareness messages and posters]. (AT-2b)
- The [Chief Information Security Officer] shall update literacy training and awareness content [Fill in: the frequency at which to update literacy training and awareness content. Typical: annually] and following [Fill in: events that would require literacy training and awareness content to be updated. Typical: a significant incident, or a significant change in threats]. (AT-2c)
- The [Chief Information Security Officer] shall incorporate lessons learned from internal and external security incidents and breaches into literacy training and awareness techniques. (AT-2d)

##### Federal systems

[5 CFR 930.301](https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-930/subpart-C/section-930.301) (OPM) requires that all users of federal information systems be exposed to security awareness materials at least annually, and that new employees receive awareness material before they are allowed access. [44 U.S.C. § 3554(b)(4)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim) requires security awareness training for personnel, including contractors and other users. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016), Appendix II, section 5.g, requires mandatory agency-wide privacy awareness and training for all employees and contractors. Checked September 2026.

- The [Chief Information Security Officer] shall give new employees security awareness material before they are allowed access to federal information systems. (AT-2a.1)
- The [Chief Information Security Officer] shall expose every user of federal information systems, including contractors, to security awareness materials at least annually. (AT-2a.1)
- The [Senior privacy official] shall maintain mandatory privacy awareness and training for all employees and contractors, as OMB Circular A-130 Appendix II requires. (AT-2a.1)

#### Role-based training (AT-3)

- The [Chief Information Security Officer] shall provide role-based security training to personnel with these roles and responsibilities: [Fill in: roles and responsibilities for role-based security training. Typical: system administrators, developers, security staff, incident responders, system owners and authorizing officials]. (AT-3a)
- The [Senior privacy official] shall provide role-based privacy training to personnel with these roles and responsibilities: [Fill in: roles and responsibilities for role-based privacy training. Typical: staff who handle personally identifiable information as part of their duties, the privacy office, and owners of systems that process it]. (AT-3a)
- Role-based training shall be completed before the person is authorized to access the system or information, or to perform the assigned duties, and [Fill in: the frequency at which to provide role-based security and privacy training to assigned personnel after initial training. Typical: annually] thereafter. (AT-3a.1)
- Role-based training shall also be provided when system changes require it. (AT-3a.2)
- The [Chief Information Security Officer] and the [Senior privacy official] shall update role-based training content [Fill in: the frequency at which to update role-based training content. Typical: annually] and following [Fill in: events that require role-based training content to be updated. Typical: a significant incident, a change in a role's tools or duties, or a new legal or policy requirement]. (AT-3b)
- The [Chief Information Security Officer] and the [Senior privacy official] shall incorporate lessons learned from internal and external security incidents and breaches into role-based training. (AT-3c)

##### Federal systems

[5 CFR 930.301](https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-930/subpart-C/section-930.301) (OPM) requires agencies to identify employees with significant information security responsibilities and give them role-specific training in accordance with NIST standards and guidance; refresher training as often as the agency determines necessary, based on the sensitivity of the information; and training when the system environment or procedures change significantly, or when an employee enters a position that needs more role-specific training. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix II, section 5.g, requires role-based privacy training, before access or assigned duties, for employees and contractors with privacy roles, including managers. Checked September 2026.

- The [Chief Information Security Officer] shall identify employees with significant information security responsibilities and give them role-specific training in accordance with NIST standards and guidance. (AT-3a)
- The [Chief Information Security Officer] shall provide role-specific training when an employee enters a position that requires more of it, and when the system environment or procedures change significantly. (AT-3a.2)
- The [Senior privacy official] shall provide role-based privacy training to employees and contractors with privacy roles, including managers, before they are authorized to access federal information or systems or to perform their duties. (AT-3a.1)

#### Processing personally identifiable information (AT-3(5))

- The [Senior privacy official] shall provide [Fill in: personnel or roles to be provided with initial and refresher training in the employment and operation of personally identifiable information processing and transparency controls. Typical: personnel who design, operate or manage systems or processes that handle personally identifiable information, and the privacy office] with initial training, and refresher training [Fill in: the frequency at which to provide refresher training in the employment and operation of personally identifiable information processing and transparency controls. Typical: annually], in the use and operation of the controls for processing personally identifiable information and for transparency. (AT-3(5))

#### Training records (AT-4)

- The [Chief Information Security Officer] shall document security and privacy training activities, including literacy training, awareness activities and role-based training, for each person. (AT-4a)
- The [Chief Information Security Officer] shall monitor training records for training that is overdue, and report overdue training to the person's supervisor. (AT-4a)
- The [Chief Information Security Officer] shall retain individual training records for [Fill in: time period for retaining individual training records. Typical: 3 years after completion, or longer where a law, the records retention schedule or a business need requires it]. (AT-4b)

##### Federal systems

The NARA [General Records Schedule 2.6](https://www.archives.gov/files/records-mgmt/grs/grs02-6.pdf), Employee Training Records (Transmittal 35, May 2024), item 030, covers individual employee training records: "Destroy when superseded, 3 years old, or 1 year after separation, whichever comes first, but longer retention is authorized if required for business use." Checked September 2026.

- The [Chief Information Security Officer] shall retain and dispose of individual training records as GRS 2.6 item 030, or the agency's own approved records schedule, requires. (AT-4b)

### Audit and Accountability (AU)

#### Event logging (AU-2)

- The [System owner] shall identify [Fill in: the event types that the system is capable of logging in support of the audit function. Typical: logons and logoffs, account and privilege changes, use of privileged functions, access to security-relevant files, configuration changes, and security tool events] as the event types the system is capable of logging in support of the audit function. (AU-2a)
- The [Chief Information Security Officer] shall coordinate the event logging function with the other organizational entities that need audit-related information, to inform which events are logged. (AU-2b)
- The [System owner] shall specify [Fill in: event types (subset of the event types defined in AU-2a.) along with the frequency of (or situation requiring) logging for each identified event type. Typical: the event types listed in the audit logging standard, each logged whenever it occurs] for logging within the system. (AU-2c)
- The [System owner] shall document why the event types selected for logging are adequate to support after-the-fact investigation of incidents. (AU-2d)
- The [System owner] shall review and update the event types selected for logging [Fill in: the frequency of event types selected for logging are reviewed and updated. Typical: annually and after a significant incident or system change]. (AU-2e)

#### Limit personally identifiable information elements (AU-3(3))

- For a system that processes personally identifiable information, the [System owner] shall limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [Fill in: elements identified in the privacy risk assessment. Typical: the account identifier, the source address and device, and the identifiers of records accessed, not their contents]. (AU-3(3))
- The [Senior privacy official] shall review, with the [System owner], the personally identifiable information elements the system writes to audit records, and the [System owner] shall record the approved elements in the privacy impact assessment. (AU-3(3))
- The [System owner] shall ensure request bodies, form inputs, query strings and other content that may hold personally identifiable information are masked, truncated or left out of audit records unless the privacy impact assessment lists them as needed. (AU-3(3))

#### Audit record retention (AU-11)

- The [System owner] shall retain audit records for [Fill in: a time period to retain audit records that is consistent with the records retention policy. Typical: at least one year, or longer where the records retention schedule or a law requires it] to support after-the-fact investigation of incidents and to meet regulatory and organizational retention requirements. (AU-11)

##### Federal systems

[OMB M-26-14](https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf), Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats (May 22, 2026), rescinded OMB M-21-31. Its Appendix B requires retained logs to be actively searchable for at least 6 months after creation and retrievable for a year after creation, and notes that meeting these minimums does not relieve agencies of other requirements, such as those set by agency-specific or government-wide records schedules. It does not apply to national security systems. As of September 2026.

- The [System owner] shall keep audit records actively searchable for at least 6 months after creation, and retrievable for at least one year after creation, as OMB M-26-14 requires. (AU-11)

### Assessment, Authorization, and Monitoring (CA)

#### Control assessments (CA-2)

- The [Chief Information Security Officer] shall select, for each assessment, an assessor or assessment team with the skills and technical knowledge the type of assessment and the system's technologies call for. (CA-2a)
- The assessor shall develop an assessment plan that names the controls and control enhancements under assessment. (CA-2b.1)
- The assessment plan shall describe the assessment procedures used to determine control effectiveness. (CA-2b.2)
- The assessment plan shall describe the assessment environment, the assessment team, and the assessment roles and responsibilities. (CA-2b.3)
- The [System owner] shall obtain the review and approval of the assessment plan by the authorizing official or the authorizing official's designated representative before the assessment begins. (CA-2c)
- The assessor shall assess the controls in the system and its environment of operation before the system's initial authorization, and [Fill in: the frequency at which to assess controls in the system and its environment of operation. Typical: annually for a subset of controls set by the system's continuous monitoring strategy, so every control is assessed at least every three years and within the authorization period] after it, to determine whether the controls are implemented correctly, operating as intended and producing the desired outcome with respect to the system's security and privacy requirements. (CA-2d)
- The assessor shall produce an assessment report that documents the results of the assessment, including whether each control assessed is satisfied or other than satisfied, and the evidence for each result. (CA-2e)
- The assessor shall provide the results of each control assessment to [Fill in: individuals or roles to whom control assessment results are to be provided. Typical: the authorizing official, the system owner and the Chief Information Security Officer]. (CA-2f)
- For a system that processes personally identifiable information, the assessor shall also provide the results of the privacy control assessment to the [Senior privacy official]. (CA-2f)

##### Federal systems

The Federal Information Security Modernization Act requires each agency's information security program to include periodic testing and evaluation of the effectiveness of its information security policies, procedures and practices, "to be performed with a frequency depending on risk, but no less than annually", including testing of the management, operational and technical controls of every information system in the agency's inventory, and using automated tools ([44 U.S.C. § 3554(b)(5)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim)). [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.c(13) and (14), requires agencies to conduct and document assessments of all selected and implemented security and privacy controls, before a system operates and periodically thereafter, at the frequency the agency's information security continuous monitoring and privacy continuous monitoring strategies set. As of September 2026.

- The [Chief Information Security Officer] shall ensure the controls of every system in the agency's system inventory are tested and evaluated at a frequency that depends on risk, and no less than annually, using automated tools where they apply, as 44 U.S.C. § 3554(b)(5) requires. (CA-2d)
- The [Chief Information Security Officer] shall ensure the assessment frequency set under CA-2d is consistent with the agency's information security continuous monitoring and privacy continuous monitoring strategies and its risk tolerance, as OMB Circular A-130, Appendix I, section 4.c(14), requires. (CA-2d)

#### Plan of action and milestones (CA-5)

- The [System owner] shall develop a plan of action and milestones for the system that documents the planned remediation actions to correct weaknesses or deficiencies noted during control assessments and to reduce or eliminate known vulnerabilities in the system. (CA-5a)
- Each item in the plan of action and milestones shall record the weakness and its source, the responsible person or team, the resources required, the milestones and the scheduled completion date. (CA-5a)
- The [System owner] shall update the plan of action and milestones [Fill in: the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. Typical: at least monthly, and whenever an assessment, audit, scan or monitoring activity finds a new weakness], based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. (CA-5b)
- The [System owner] shall record the reason for each change to a scheduled completion date, and close an item only with evidence that the weakness is corrected. (CA-5b)
- The [Chief Information Security Officer] shall review items past their scheduled completion date each month, and report them to the authorizing official. (CA-5b)

##### Federal systems

The Federal Information Security Modernization Act requires each agency's information security program to include "a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency" ([44 U.S.C. § 3554(b)(6)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim)). [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.c(15), requires agencies to use POA&Ms to record and manage the mitigation and remediation of identified weaknesses and deficiencies not associated with accepted risks, and to make them available to OMB, DHS, inspectors general and the U.S. Government Accountability Office on request. Section 4.k requires agencies to correct deficiencies identified through assessments, continuous monitoring and audits, and to track and manage their remediation through the POA&M process, with material deficiencies also reported in the annual Federal Managers Financial Integrity Act report. As of September 2026.

- The [System owner] shall record in the plan of action and milestones each weakness and deficiency not associated with an accepted risk, including those found by OMB reviews and internal or external audits, as OMB Circular A-130, Appendix I, sections 4.c(15) and 4.k, requires. (CA-5a)
- The [Chief Information Security Officer] shall make plans of action and milestones available to OMB, DHS, the inspector general and the U.S. Government Accountability Office on request, as OMB Circular A-130, Appendix I, section 4.c(15), requires. (CA-5b)

#### Authorization (CA-6)

- The [Senior leader] shall assign a senior official, with budget or mission responsibility for the system, as the authorizing official for the system. (CA-6a)
- The [Senior leader] shall assign a senior official as the authorizing official for the common controls available for inheritance by organizational systems. (CA-6b)
- The [System owner] shall ensure that, before the system begins operating, the authorizing official for the system accepts the use of the common controls the system inherits. (CA-6c.1)
- The [System owner] shall ensure that the authorizing official authorizes the system to operate, based on the authorization package, before the system begins operating. (CA-6c.2)
- The authorizing official's decision shall be recorded in a signed authorization decision document that states the decision, any terms and conditions, and the authorization termination date or that the system is under ongoing authorization. (CA-6c.2)
- The [Chief Information Security Officer] shall ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems. (CA-6d)
- The authorizing official shall update the authorization [Fill in: frequency at which to update the authorizations. Typical: at least every three years and after a significant change, or on the time- or event-driven basis the continuous monitoring strategy sets once the authorizing official moves the system to ongoing authorization]. (CA-6e)
- When the authorizing official changes, the new authorizing official shall review the current authorization and either accept the documented risk in a new signed decision or begin a reauthorization. (CA-6e)

##### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.d(1) to (4), requires agencies to designate senior Federal officials to authorize systems and agency-designated common controls; to complete an initial authorization to operate for each system and all agency-designated common controls, based on an explicit acceptance of risk, before operation; to move systems and common controls to an ongoing authorization process when eligible and with the authorizing official's formal approval; and to reauthorize them as needed, on a time- or event-driven basis, in line with agency risk tolerance. Section 5.f states that only Federal Government personnel may serve as an authorizing official, and that the agency must consider the Senior Agency Official for Privacy's input in the authorization decision. Section 5.h sets two conditions for ongoing authorization: an initial authorization to operate, and continuous monitoring programs that monitor all implemented security and privacy controls at the frequencies the strategies set; until the authorizing official formally approves the transition, the system keeps a specific authorization termination date. NIST SP 800-37 Rev. 2 ([December 2018](https://csrc.nist.gov/pubs/sp/800/37/r2/final), current as of September 2026) describes the authorization tasks. As of September 2026.

- The [Senior leader] shall assign only Federal Government personnel as authorizing officials, as OMB Circular A-130, Appendix I, section 5.f, requires. (CA-6a)
- For a system that processes personally identifiable information, the authorizing official shall consider the input and recommendations of the Senior Agency Official for Privacy before making the authorization decision, as OMB Circular A-130, Appendix I, section 5.f, requires. (CA-6c.2)
- The [System owner] shall move the system to ongoing authorization only after an initial authorization to operate, with a continuous monitoring program that meets the conditions of OMB Circular A-130, Appendix I, section 5.h, and with the authorizing official's formal approval. (CA-6e)

#### Continuous monitoring (CA-7)

- The [System owner] shall develop a system-level continuous monitoring strategy that follows the organization-wide continuous monitoring strategy, and implement continuous monitoring in accordance with it. (CA-7)
- The system-level strategy shall establish the following system-level metrics to be monitored: [Fill in: system-level metrics to be monitored. Typical: open vulnerabilities by severity and age, configuration compliance rate, plan of action and milestones items past due, and unauthorized components found]. (CA-7a)
- The system-level strategy shall establish that control effectiveness is monitored [Fill in: frequencies at which to monitor control effectiveness. Typical: continuously for automated controls, and at least monthly for vulnerability, configuration and account data]. (CA-7b)
- The system-level strategy shall establish that control effectiveness is assessed at [Fill in: frequencies at which to assess control effectiveness. Typical: the schedule in the system's continuous monitoring strategy, assessing a third of the controls each year so every control is assessed at least every three years]. (CA-7b)
- The [System owner] shall ensure ongoing control assessments are carried out in accordance with the continuous monitoring strategy. (CA-7c)
- The [System owner] shall ensure the system-level and organization-defined metrics are monitored on an ongoing basis in accordance with the continuous monitoring strategy. (CA-7d)
- The [System owner] shall correlate and analyze the information that control assessments and monitoring produce. (CA-7e)
- The [System owner] shall take response actions to address the results of that analysis, recording weaknesses in the plan of action and milestones (CA-5) and raising risks above tolerance with the authorizing official. (CA-7f)
- The [System owner] shall report the security status of the system to [Fill in: personnel or roles to whom the security status of the system is reported. Typical: the authorizing official and the Chief Information Security Officer], [Fill in: frequency at which the security status of the system is reported. Typical: at least quarterly]. (CA-7g)
- For a system that processes personally identifiable information, the [System owner] shall report the privacy status of the system to [Fill in: personnel or roles to whom the privacy status of the system is reported. Typical: the authorizing official and the senior privacy official], [Fill in: frequency at which the privacy status of the system is reported. Typical: at least quarterly]. (CA-7g)
- The [System owner] shall review and update the system-level strategy when the system changes significantly, when the organization-wide strategy changes, and at least annually. (CA-7)

##### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.d(5) to (8), requires agencies to develop and maintain an information security continuous monitoring (ISCM) strategy, update it at an organization-defined frequency, ensure all selected and implemented controls are addressed in it and effectively monitored on an ongoing basis, and keep an ISCM program with metrics that give meaningful indications of security status and trend analysis at every risk management tier. Section 4.d(9) adds a privacy continuous monitoring (PCM) strategy; footnote 85 allows the two strategies to be combined into one. Section 5.c says that, after the authorization decision, agencies monitor the controls in each system on an ongoing basis, as described in NIST SP 800-137, including assessing control effectiveness, documenting changes, analyzing their security impact and reporting the system's security state to designated officials. As of September 2026.

- The [System owner] shall ensure every control selected and implemented for the system is addressed in the system-level strategy and monitored on an ongoing basis, as OMB Circular A-130, Appendix I, section 4.d(7), requires. (CA-7c)
- The [System owner] shall ensure the system-level strategy follows the agency's ISCM strategy and, for a system that processes personally identifiable information, its PCM strategy, or the single strategy that combines them. (CA-7)

#### Risk monitoring (CA-7(4))

- The [System owner] shall make risk monitoring an integral part of the system's continuous monitoring strategy, informed by the organization's risk tolerance. (CA-7(4))
- The strategy shall include effectiveness monitoring, to determine whether the implemented risk response measures remain effective. (CA-7(4)(a))
- The strategy shall include compliance monitoring, to verify that required risk response measures are implemented and that security and privacy requirements are satisfied. (CA-7(4)(b))
- The strategy shall include change monitoring, to identify changes to the system and its environment of operation that may affect security and privacy risk. (CA-7(4)(c))

### Configuration Management (CM)

#### Impact analyses (CM-4)

- The [System owner] shall analyze changes to the system to determine potential security and privacy impacts before the changes are implemented. (CM-4)

### Incident Response (IR)

#### Incident response training (IR-2)

- The [Incident response team] shall provide incident response training, consistent with assigned roles and responsibilities, to system users within [Fill in: a time period within which incident response training is to be provided to system users assuming an incident response role or responsibility. Typical: 30 days] of their assuming an incident response role or responsibility or acquiring system access. (IR-2a.1)
- The [Incident response team] shall provide that training when system changes require it. (IR-2a.2)
- The [Incident response team] shall provide that training [Fill in: frequency at which to provide incident response training to users. Typical: annually] thereafter. (IR-2a.3)
- The [Incident response team] shall review and update incident response training content [Fill in: frequency at which to review and update incident response training content. Typical: annually] and following [Fill in: events that initiate a review of the incident response training content. Typical: a change to the incident response plan, and lessons learned from an incident or exercise]. (IR-2b)

#### Breach (IR-2(3))

- For a system that processes personally identifiable information, the [Incident response team] shall provide incident response training on how to identify and respond to a breach, including the organization's process for reporting a breach. (IR-2(3))
- The training shall teach that every person must report both confirmed and suspected breaches involving information in any medium or form, including paper, oral and electronic, within the time the incident reporting statement sets (IR-6a), and shall give examples drawn from the system's own information. (IR-2(3))
- The [Senior privacy official] shall review the breach content of incident response training each time the content is reviewed under IR-2b, and after each breach. (IR-2(3))
- The [Incident response team] shall include, in each annual cycle of incident response training, a tabletop exercise that simulates a breach for the personnel the incident response plan gives breach response roles. (IR-2(3))

##### Federal systems

[OMB Memorandum M-17-12](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2017/m-17-12_0.pdf), Preparing for and Responding to a Breach of Personally Identifiable Information (January 3, 2017), sets agency breach policy; OMB's FY 2026 SAOP FISMA reporting metrics (August 2026) still cite it. Section IV requires each agency to train all individuals with access to its Federal information and information systems, including detailees, contractors, grantees, volunteers and interns, on how to identify and respond to a breach, including the agency's internal reporting process, before they access Federal information or systems and in annual privacy and security awareness training. Section VI requires everyone with access to report a suspected or confirmed breach "as soon as possible and without unreasonable delay", in any medium or form, without waiting for confirmation. Section X.A requires the senior agency official for privacy to convene the breach response team for a tabletop exercise periodically, but not less than annually. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.f(7), also requires training and awareness for employees and contractors on how to report and respond to incidents. As of October 2026.

- Breach training shall be given to every individual with access to agency information or information systems, including detailees, contractors, grantees, volunteers and interns, before they are granted access and in the annual privacy and security awareness training, as OMB M-17-12, section IV, requires. (IR-2(3))
- The training shall teach that a suspected or confirmed breach is reported as soon as possible and without unreasonable delay, without waiting for confirmation, as OMB M-17-12, section VI, requires. (IR-2(3))
- The [Senior privacy official] shall convene the agency's breach response team for a breach tabletop exercise at least annually, as OMB M-17-12, section X.A, requires. (IR-2(3))

#### Incident response testing (IR-3)

- The [Incident response team] shall test the effectiveness of the incident response capability for the system [Fill in: frequency at which to test the effectiveness of the incident response capability for the system. Typical: annually] using [Fill in: tests used to test the effectiveness of the incident response capability for the system. Typical: a tabletop exercise based on a realistic scenario, and a functional test of notification and escalation]. (IR-3)

#### Incident handling (IR-4)

- The [Incident response team] shall implement an incident handling capability, consistent with the incident response plan, that includes preparation, detection and analysis, containment, eradication and recovery. (IR-4a)
- The [Incident response team] shall coordinate incident handling activities with contingency planning activities. (IR-4b)
- The [Incident response team] shall incorporate lessons learned from incident handling into incident response procedures, training and testing, and implement the resulting changes. (IR-4c)
- The [Chief Information Security Officer] shall ensure the rigor, intensity, scope and results of incident handling are comparable and predictable across the organization. (IR-4d)

#### Incident monitoring (IR-5)

- The [Incident response team] shall track and document incidents. (IR-5)

#### Incident reporting (IR-6)

- All personnel shall report suspected incidents to the [Incident response team] within [Fill in: time period for personnel to report suspected incidents to the organizational incident response capability. Typical: 1 hour of discovery]. (IR-6a)
- The [Incident response team] shall report incident information to [Fill in: authorities to whom incident information is to be reported. Typical: senior leadership, legal counsel, and any regulator, customer or partner that law or contract requires be notified]. (IR-6b)

##### Federal systems

Federal agencies notify the Cybersecurity and Infrastructure Security Agency (CISA) of incidents under FISMA (44 U.S.C. §§ 3553 and 3554). As of September 2026, the [CISA Federal Incident Notification Guidelines](https://www.cisa.gov/federal-incident-notification-guidelines) (effective April 1, 2017) set the time frame: within one hour of the incident being identified by the agency's top-level incident response team, security operations center or IT department.

- The [Incident response team] shall report incidents to CISA within one hour of identification, as the CISA Federal Incident Notification Guidelines require. (IR-6b)

#### Incident response assistance (IR-7)

- The [Incident response team] shall provide an incident response support resource, as part of the incident response capability, that offers system users advice and assistance with handling and reporting incidents. (IR-7)

#### Incident response plan (IR-8)

- The [Chief Information Security Officer] shall develop an incident response plan that provides a roadmap for implementing the incident response capability. (IR-8a.1)
- The plan shall describe the structure and organization of the incident response capability. (IR-8a.2)
- The plan shall describe at a high level how the incident response capability fits into the overall organization. (IR-8a.3)
- The plan shall meet the organization's unique requirements related to its mission, size, structure and functions. (IR-8a.4)
- The plan shall define reportable incidents. (IR-8a.5)
- The plan shall provide metrics for measuring the incident response capability. (IR-8a.6)
- The plan shall define the resources and management support needed to maintain and mature the incident response capability. (IR-8a.7)
- The plan shall address the sharing of incident information. (IR-8a.8)
- The plan shall be reviewed and approved by [Fill in: personnel or roles that review and approve the incident response plan. Typical: the Chief Information Security Officer] [Fill in: the frequency at which to review and approve the incident response plan. Typical: annually]. (IR-8a.9)
- The plan shall explicitly designate responsibility for incident response to [Fill in: entities, personnel, or roles with designated responsibility for incident response. Typical: the incident response team, led by its designated lead]. (IR-8a.10)
- The [Chief Information Security Officer] shall distribute copies of the plan to [Fill in: incident response personnel (identified by name and/or by role) to whom copies of the incident response plan are to be distributed. Typical: the incident response team members, by role] and [Fill in: organizational elements to which copies of the incident response plan are to be distributed. Typical: the security operations, legal, communications and human resources functions]. (IR-8b)
- The [Chief Information Security Officer] shall update the plan to address system and organizational changes, and problems found during its implementation, execution or testing. (IR-8c)
- The [Chief Information Security Officer] shall communicate changes to the plan to [Fill in: incident response personnel (identified by name and/or by role) and organizational elements. Typical: everyone who received the plan]. (IR-8d)
- The [Chief Information Security Officer] shall protect the plan from unauthorized disclosure and modification. (IR-8e)

#### Breaches (IR-8(1))

- For breaches involving personally identifiable information, the incident response plan shall include a process, led by the [Senior privacy official], to determine whether notice to individuals or other organizations, including oversight organizations, is needed. (IR-8(1)(a))
- The plan shall include an assessment process to determine the extent of the harm, embarrassment, inconvenience or unfairness to affected individuals, and the mechanisms available to mitigate those harms. (IR-8(1)(b))
- The plan shall identify the privacy requirements that apply to breaches, including each law, regulation, policy and contract that sets a notice, a standard of harm or a mitigation duty, with the notice each requires, to whom and by when. (IR-8(1)(c))
- The [Incident response team] shall notify the [Senior privacy official] of every incident that involves, or may involve, personally identifiable information as soon as it is identified, and the [Senior privacy official] shall take part in its response. (IR-8(1))
- The [Senior privacy official] shall record each harm assessment, notification decision and mitigation decision in the incident record, with who decided and when. (IR-8(1))
- The [Senior privacy official] shall review the list of applicable privacy requirements each time the plan is reviewed, and when a law, regulation or contract changes. (IR-8(1)(c))

##### Federal systems

The Privacy Act requires each agency that maintains a system of records to establish appropriate administrative, technical and physical safeguards to protect against threats or hazards to the records' security or integrity "which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained" ([5 U.S.C. § 552a(e)(10)](https://www.govinfo.gov/link/uscode/5/552a?link-type=html), United States Code, 2024 edition), the standard of harm IR-8(1)(b) repeats. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.f(7), requires incident response capabilities and mechanisms that include notification to affected individuals; section 4.f(9) requires agencies to report incidents to OMB, DHS, the CIO, the senior agency official for privacy, their inspectors general and general counsel, law enforcement and Congress in accordance with procedures issued by OMB; and section 4.j(2)(e) requires incident response procedures for systems operated on the agency's behalf, including timelines for notification of affected individuals.

[OMB Memorandum M-17-12](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2017/m-17-12_0.pdf) (January 3, 2017), which OMB's FY 2026 SAOP FISMA reporting metrics (August 2026) still cite, sets the breach procedures OMB issued. Section VII requires the senior agency official for privacy to develop and implement a breach response plan, as part of the agency's formal incident response plan, with at least these elements: the breach response team; identifying applicable privacy compliance documentation (system of records notices, privacy impact assessments and privacy notices); information sharing to respond to a breach; reporting requirements and the officials responsible; assessing the risk of harm to individuals; mitigating that risk; and notifying individuals. Section VII.A has the head of the agency designate the breach response team, led by the senior agency official for privacy and including at least the CIO or designee, the senior agency information security officer, legal counsel, and legislative affairs and communications officials; the team is always convened when a breach is a major incident. Section VII.E requires the senior agency official for privacy to conduct and document an assessment of the risk of harm, considering the nature and sensitivity of the information, the likelihood of access and use, and the type of breach. Under section VII.G, the senior agency official for privacy advises the head of the agency, who makes the final decision on whether to notify; notice is given as expeditiously as practicable and without unreasonable delay (section VII.G.2). Section VIII has the principal security operations center track and document each breach and keep the senior agency official for privacy aware of it; section IX has that center report the status of each breach to the senior agency official for privacy at the end of each quarter of the fiscal year, for that official to review and validate; and section X.B requires that official to review the plan at the end of each fiscal year.

[OMB Memorandum M-25-04](https://www.whitehouse.gov/wp-content/uploads/2025/01/M-25-04-Fiscal-Year-2025-Guidance-on-Federal-Information-Security-and-Privacy-Management-Requirements.pdf), Fiscal Year 2025 Guidance on Federal Information Security and Privacy Management Requirements (January 15, 2025), is the most recent FISMA guidance memorandum. Section X defines a major incident, including a breach of personally identifiable information likely to result in demonstrable harm to the national security interests, foreign relations or economy of the United States, or to the public confidence, civil liberties or public health and safety of the American people, and requires a major incident determination for any unauthorized modification, deletion, exfiltration of, or access to the personally identifiable information of 100,000 or more people. Agencies report a major incident to CISA and the OMB Office of the Federal Chief Information Officer within 1 hour of determining it is major, notify the appropriate congressional committees and their Office of Inspector General within 7 days of having a reasonable basis to conclude it occurred, and, for a breach that is a major incident, supplement the congressional report within 30 days of discovering the breach. Its footnote 37 keeps the major incident analysis separate from the M-17-12 assessment of the risk of harm to individuals. As of October 2026.

- The incident response plan's breach section shall serve as the agency's breach response plan under OMB M-17-12, section VII, with each element that section lists, and the [Senior privacy official] shall review it at the end of each fiscal year as section X.B requires. (IR-8(1))
- The breach section shall name the breach response team the head of the agency designates under OMB M-17-12, section VII.A, the criteria for convening it, and the officials responsible for reporting a breach to CISA, law enforcement, inspectors general, general counsel and Congress (section VII.D). (IR-8(1)(a))
- The harm assessment shall follow OMB M-17-12, section VII.E, and the [Senior privacy official] shall advise the head of the agency on whether and when to notify individuals, as section VII.G provides. (IR-8(1)(a), IR-8(1)(b))
- The breach section shall apply the major incident criteria of OMB M-25-04, section X, including the required determination for a breach affecting 100,000 or more people, and its reporting: CISA and the OMB Office of the Federal Chief Information Officer within 1 hour of the determination, the congressional committees and the Office of Inspector General within 7 days, and a supplemental report within 30 days of discovering the breach. (IR-8(1)(a))
- The plan's list of applicable privacy requirements shall include the Privacy Act for each system of records, OMB M-17-12 and OMB M-25-04, and any other breach notification requirement that applies to the system's information, such as one for health information. (IR-8(1)(c))
- The [Senior privacy official] shall ensure that contracts and agreements for systems operated on the agency's behalf set timelines for reporting breaches to the agency and for notifying affected individuals, as OMB Circular A-130, Appendix I, section 4.j(2)(e), requires. (IR-8(1))

### Media Protection (MP)

#### Media sanitization (MP-6)

- The [System owner] shall sanitize [Fill in: system media to be sanitized prior to disposal. Typical: all digital and non-digital system media, including the storage in workstations, laptops, servers, network devices, mobile devices, printers, copiers and scanners] prior to disposal using [Fill in: sanitization techniques and procedures to be used for sanitization prior to disposal. Typical: purge or destroy for digital media, and destruction by shredding or incineration for paper and other hard copy, as the media sanitization procedure sets out following NIST SP 800-88 Rev. 2]. (MP-6a)
- The [System owner] shall sanitize [Fill in: system media to be sanitized prior to release from organizational control. Typical: all digital and non-digital system media, including media returned to a lessor or vendor, exchanged under warranty, or sent off site for repair] prior to release out of organizational control using [Fill in: sanitization techniques and procedures to be used for sanitization prior to release from organizational control. Typical: purge, including cryptographic erase where its conditions are met, as the media sanitization procedure sets out following NIST SP 800-88 Rev. 2; media that cannot be purged and verified are destroyed, not released]. (MP-6a)
- The [System owner] shall sanitize [Fill in: system media to be sanitized prior to release for reuse. Typical: all digital system media reissued to another user, system or part of the organization] prior to release for reuse using [Fill in: sanitization techniques and procedures to be used for sanitization prior to release for reuse. Typical: clear for reuse within the same system or by users with the same access authorizations, and purge for other reuse, as the media sanitization procedure sets out following NIST SP 800-88 Rev. 2]. (MP-6a)
- The [Chief Information Security Officer] shall maintain a media sanitization procedure that follows NIST SP 800-88 Rev. 2 and names, for each media type in use, the sanitization method (clear, purge or destroy), the technique and tool, and how the result is verified. (MP-6a)
- Before media are sanitized, the [System owner] shall confirm that the information on them is not subject to a records retention requirement or legal hold that has not yet been met (SI-12). (MP-6a)
- Storage media that cannot be sanitized by the method the procedure requires, including failed drives, shall be kept within the organization and destroyed, and shall not be released out of organizational control. (MP-6a)
- Each sanitization shall be verified and recorded in the media sanitization record, including the media's identifiers, the method and technique, who performed and verified it, and the date. (MP-6a)
- Where an external provider sanitizes or destroys media, its contract shall specify the method, require a certificate listing each item by serial number, and allow the organization to witness or verify the work. (MP-6a)
- The [System owner] shall employ sanitization mechanisms whose strength and integrity are commensurate with the security category of the information, choosing the method by the confidentiality of the information as NIST SP 800-88 Rev. 2 describes. (MP-6b)
- Clear shall be used only for media that remain under organizational control, and then only for reuse within the same system or by users with the same access authorizations, for low-impact information, or for moderate-impact information where the [System owner] has accepted the residual risk in writing. (MP-6b)
- Storage devices holding moderate- or high-impact information shall be destroyed by disintegration, incineration or melting, or purged first, rather than only shredded or pulverized. (MP-6b)
- Cryptographic erase shall be used only where the media's encryption and key management meet the conditions in NIST SP 800-88 Rev. 2 section 3.2, and the keys are managed under the encryption and key management standard (SC-12). (MP-6b)

##### Federal systems

Under [32 CFR 2002.14(f)](https://www.ecfr.gov/current/title-32/section-2002.14), authorized holders may destroy controlled unclassified information (CUI) when the agency no longer needs it and records disposition schedules published or approved by NARA allow. Agencies destroying CUI, including in electronic form, must make it unreadable, indecipherable and irrecoverable, using any destruction method specifically required by law, regulation or Government-wide policy for that CUI; otherwise, the destruction guidance in NIST SP 800-53 and SP 800-88, or a method approved for classified national security information under 32 CFR 2001.47. Under 2002.14(e)(2), when CUI is reproduced on printers, copiers, scanners or fax machines, the equipment must not retain data, or the agency must sanitize it in accordance with NIST SP 800-53. [NIST SP 800-88 Rev. 2](https://csrc.nist.gov/pubs/sp/800/88/r2/final), section 3.2, states that federal agencies must use encryption modules validated to the current FIPS 140 standard to have assurance in cryptographic erase on self-encrypting drives. As of October 2026.

- The [System owner] shall destroy CUI only when the agency no longer needs it and NARA-approved records disposition schedules allow, and only by a method that 32 CFR 2002.14(f)(2) permits. (MP-6a)
- The [System owner] shall ensure printers, copiers, scanners and fax machines used to reproduce CUI do not retain data, or are sanitized in accordance with NIST SP 800-53, as 32 CFR 2002.14(e)(2) requires. (MP-6a)
- Cryptographic erase shall rely only on encryption modules validated to the current FIPS 140 standard. (MP-6b)

### Physical and Environmental Protection (PE)

#### Limit personally identifiable information elements (PE-8(3))

- The [Facilities manager] shall limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: [Fill in: elements identified in the privacy risk assessment to limit personally identifiable information contained in visitor access logs. Typical: the visitor's name and organization, the person visited, the purpose of the visit, the date and times of entry and departure, the badge issued and the escort; the type of identification checked, but not its number or a copy of it unless a law or regulation requires one]. (PE-8(3))
- The [Senior privacy official] shall review the elements before a visitor log, form or visitor management system is introduced or changed, and the [Facilities manager] shall remove any field that collects other elements. (PE-8(3))
- Visitor sign-in sheets shall be designed so that visitors cannot read earlier entries. (PE-8(3))

##### Federal systems

Under the Privacy Act, a system of records is a group of records under an agency's control from which information is retrieved by the name of the individual or by an identifying number, symbol or other identifying particular ([5 U.S.C. § 552a(a)(5)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)), and an agency must inform each individual it asks to supply information for one of the authority for asking and whether disclosure is mandatory or voluntary, the principal purposes, the routine uses, and the effects of not providing it ([§ 552a(e)(3)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). Text checked in the United States Code, 2024 edition, as of October 2026.

- Where visitor access records are retrieved by a visitor's name or other identifier, the [Senior privacy official] shall confirm they are covered by a published system of records notice, and the visitor log or visitor management system shall present the Privacy Act statement that 5 U.S.C. § 552a(e)(3) requires. (PE-8(3))

### Planning (PL)

#### System security and privacy plans (PL-2)

- Each [System owner] shall develop a security plan and a privacy plan for the system, as one document or two, that contain every element PL-2a.1 to a.14 lists. (PL-2a)
- The plans shall identify the security- and privacy-related activities affecting the system that require planning and coordination with [Fill in: individuals or groups with whom security and privacy-related activities affecting the system that require planning and coordination. Typical: the system's stakeholders, the common control providers, and the security and privacy teams]. (PL-2a.14)
- The [System owner] shall have the plans reviewed and approved by the authorizing official, or a designated representative, before the plans are implemented. (PL-2a.15)
- The [System owner] shall distribute copies of the plans, and communicate later changes to them, to [Fill in: personnel or roles to receive distributed copies of the system security and privacy plans. Typical: the authorizing official, the system owner, the system security officer and the assessor]. (PL-2b)
- The [System owner] shall review the plans [Fill in: frequency to review system security and privacy plans. Typical: annually]. (PL-2c)
- The [System owner] shall update the plans to address changes to the system and its environment of operation, and problems found during plan implementation or control assessments. (PL-2d)
- The [System owner] shall protect the plans from unauthorized disclosure and modification. (PL-2e)

#### Rules of behavior (PL-4)

- The [Chief Information Security Officer] shall establish rules that describe the responsibilities and expected behavior of individuals for information and system usage, security and privacy. (PL-4a)
- The [Chief Information Security Officer] shall provide the rules to each individual who requires access to the system. (PL-4a)
- The [Account manager] shall receive a documented acknowledgment from each individual, stating that they have read, understand and agree to abide by the rules, before authorizing access to information and the system. (PL-4b)
- The [Chief Information Security Officer] shall review and update the rules of behavior [Fill in: frequency for reviewing and updating the rules of behavior. Typical: annually]. (PL-4c)
- The [Chief Information Security Officer] shall require individuals who acknowledged a previous version of the rules to read and re-acknowledge them [Select one or more: [Assignment: organization-defined frequency]; when the rules are revised or updated. Typical: annually, and when the rules are revised or updated]. (PL-4d)

#### Social media and external site and application usage restrictions (PL-4(1))

- The rules of behavior shall restrict the use of social media, social networking sites, and external sites and applications. (PL-4(1)(a))
- The rules of behavior shall restrict the posting of organizational information on public websites. (PL-4(1)(b))
- The rules of behavior shall restrict the use of organization-provided identifiers, such as email addresses, and authentication secrets, such as passwords, to create accounts on external sites and applications. (PL-4(1)(c))

#### Security and privacy architectures (PL-8)

- Each [System owner] shall develop a security architecture and a privacy architecture for the system. (PL-8a)
- The architectures shall describe the requirements and approach for protecting the confidentiality, integrity and availability of organizational information. (PL-8a.1)
- The architectures shall describe the requirements and approach for processing personally identifiable information so as to minimize privacy risk to individuals. (PL-8a.2)
- The architectures shall describe how they are integrated into and support the enterprise architecture. (PL-8a.3)
- The architectures shall describe any assumptions about, and dependencies on, external systems and services. (PL-8a.4)
- The [System owner] shall review and update the architectures [Fill in: frequency for review and update to reflect changes in the enterprise architecture. Typical: annually, and whenever the enterprise architecture changes] to reflect changes in the enterprise architecture. (PL-8b)
- The [System owner] shall reflect planned architecture changes in the security and privacy plans, the concept of operations, the criticality analysis, organizational procedures, and procurements and acquisitions. (PL-8c)

#### Central management (PL-9)

- The [Senior privacy official] shall centrally manage [Fill in: security and privacy controls and related processes to be centrally managed. Typical: the privacy controls and processes the privacy program provides for all systems, such as privacy notices, privacy impact assessments, complaint handling and breach response]. (PL-9)
- The [Senior privacy official] shall record the centrally managed controls in the privacy program plan, so that system privacy plans can inherit them. (PL-9)

### Program Management (PM)

#### Information security program plan (PM-1)

- The [Chief Information Security Officer] shall develop, maintain and disseminate an organization-wide information security program plan. (PM-1a)
- The plan shall give an overview of the requirements for the security program, and describe the program management controls and common controls in place or planned to meet them. (PM-1a.1)
- The plan shall identify and assign roles and responsibilities, and describe management commitment, coordination among organizational entities, and compliance. (PM-1a.2)
- The plan shall reflect the coordination among the organizational entities responsible for information security. (PM-1a.3)
- The [Senior leader], as the senior official accountable for the risk the organization incurs, shall approve the plan. (PM-1a.4)
- The [Chief Information Security Officer] shall disseminate the approved plan to every system owner and authorizing official and to the leaders of the functions named under Coordination. (PM-1a)
- The [Chief Information Security Officer] shall review and update the plan [Fill in: the frequency at which to review and update the organization-wide information security program plan. Typical: annually] and following [Fill in: events that trigger the review and update of the organization-wide information security program plan. Typical: a significant change to the organization's mission, structure, risk tolerance or systems, a major incident, or a finding from an assessment or audit of the program]. (PM-1b)
- The [Chief Information Security Officer] shall protect the plan from unauthorized disclosure and modification by limiting who can change it and keeping each approved version. (PM-1c)

##### Federal systems

For federal agencies, this policy carries out the agency-wide information security program required by the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554(b)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim)) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- The program plan shall carry out the agency-wide information security program that 44 U.S.C. § 3554(b) requires. (PM-1a)

#### Information security program leadership role (PM-2)

- The [Senior leader] shall appoint a [Chief Information Security Officer] to coordinate, develop, implement and maintain the organization-wide information security program. (PM-2)
- The [Senior leader] shall record the appointment in writing and give the [Chief Information Security Officer] the mission and resources the role needs. (PM-2)

##### Federal systems

FISMA requires the agency head to delegate to the Chief Information Officer the authority to ensure compliance, including designating a senior agency information security officer who has information security duties as that official's primary duty and heads an office with the mission and resources to assist in ensuring compliance ([44 U.S.C. § 3554(a)(3)(A)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim)).

- The [Chief Information Security Officer] shall be the senior agency information security officer designated under 44 U.S.C. § 3554(a)(3)(A), with information security duties as that official's primary duty. (PM-2)

#### Information security and privacy resources (PM-3)

- The [Chief Information Security Officer] and the [Senior privacy official] shall identify the resources the information security and privacy programs need, for each capital planning and investment request. (PM-3a)
- The [Senior leader] shall include those resources in capital planning and investment requests, and document every exception. (PM-3a)
- The [Chief Information Security Officer] and the [Senior privacy official] shall prepare the security and privacy documentation that capital planning and investment requests require under applicable laws, regulations, policies and standards. (PM-3b)
- The [Senior leader] shall make the planned information security and privacy resources available for expenditure. (PM-3c)

#### Plan of action and milestones process (PM-4)

- The [Chief Information Security Officer] shall maintain a process that ensures plans of action and milestones are developed and maintained for the information security, privacy and supply chain risk management programs and for each organizational system. (PM-4a.1)
- Each plan of action and milestones shall document the remedial actions planned to respond to risk to organizational operations and assets, individuals, other organizations and the Nation. (PM-4a.2)
- The [Chief Information Security Officer] shall report plans of action and milestones to the [Senior leader] [Fill in: how often, for example quarterly], and to regulators and customers as laws and contracts require. (PM-4a.3)
- The [Chief Information Security Officer] shall review plans of action and milestones for consistency with the risk management strategy and the organization-wide priorities for risk response. (PM-4b)

#### System inventory (PM-5)

- The [Chief Information Security Officer] shall maintain an inventory of organizational systems and update it [Fill in: the frequency at which to update the inventory of organizational systems. Typical: quarterly, and whenever a system is authorized, significantly changed or retired]. (PM-5)
- Each [System owner] shall add a system to the inventory before it is authorized or placed in operation. (PM-5)

##### Federal systems

The Paperwork Reduction Act requires each agency head to maintain an inventory of major information systems, updated at least annually ([44 U.S.C. § 3505(c)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3505&num=0&edition=prelim)).

- The [Chief Information Security Officer] shall update the inventory at least annually and whenever the agency adds, significantly changes or retires a major information system. (PM-5)

#### Inventory of personally identifiable information (PM-5(1))

- The [Senior privacy official] shall establish, maintain and update [Fill in: the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information. Typical: at least annually, and whenever a privacy impact assessment is completed or updated] an inventory of all systems, applications and projects that process personally identifiable information. (PM-5(1))

#### Measures of performance (PM-6)

- The [Chief Information Security Officer] shall develop, monitor and report on measures of performance for the information security program. (PM-6)
- The [Senior privacy official] shall develop, monitor and report on measures of performance for the privacy program. (PM-6)
- The [Chief Information Security Officer] and the [Senior privacy official] shall report the results to the [Senior leader]. (PM-6)

#### Enterprise architecture (PM-7)

- The [Chief Information Security Officer] shall ensure the enterprise architecture is developed and maintained with consideration for information security, privacy and the resulting risk to organizational operations and assets, individuals, other organizations and the Nation. (PM-7)
- The [Senior privacy official] shall review changes to the enterprise architecture that affect the processing of personally identifiable information. (PM-7)

#### Offloading (PM-7(1))

- Each [System owner] shall offload [Fill in: non-essential functions or services to be offloaded. Typical: non-essential services, such as email, file sharing and public web hosting, on systems that support mission-essential functions] to other systems, system components or an external provider. (PM-7(1))

#### Critical infrastructure plan (PM-8)

- The [Chief Information Security Officer] and the [Senior privacy official] shall address information security and privacy issues when the organization develops, documents and updates its critical infrastructure and key resources protection plan. (PM-8)

#### Risk management strategy (PM-9)

- The [Chief Information Security Officer] shall develop an organization-wide risk management strategy for security risk to organizational operations and assets, individuals, other organizations and the Nation from the operation and use of organizational systems. (PM-9a.1)
- The strategy shall also address privacy risk to individuals from the authorized processing of personally identifiable information, developed with the [Senior privacy official]. (PM-9a.2)
- The [Senior leader] shall approve the strategy. (PM-9a)
- The [Chief Information Security Officer] shall implement the strategy consistently across the organization. (PM-9b)
- The [Chief Information Security Officer] shall review and update the strategy [Fill in: the frequency at which to review and update the risk management strategy. Typical: annually], and whenever organizational changes require it. (PM-9c)

#### Authorization process (PM-10)

- The [Chief Information Security Officer] shall manage the security and privacy state of organizational systems, and the environments they operate in, through an authorization process. (PM-10a)
- The [Senior leader] shall designate the individuals who fill the roles in the risk management process, including an authorizing official for each system. (PM-10b)
- The [Chief Information Security Officer] shall integrate the authorization process into the organization-wide risk management program. (PM-10c)

#### Mission and business process definition (PM-11)

- The [Senior leader] shall ensure the organization's mission and business processes are defined with consideration for information security, privacy and the resulting risk to organizational operations and assets, individuals, other organizations and the Nation. (PM-11a)
- The [Chief Information Security Officer] and the [Senior privacy official] shall determine the information protection and personally identifiable information processing needs that arise from those processes. (PM-11b)
- The [Senior leader] shall review and revise the mission and business processes [Fill in: the frequency at which to review and revise the mission and business processes. Typical: annually, and whenever the organization changes its mission, structure or major services]. (PM-11c)

#### Insider threat program (PM-12)

- The [Chief Information Security Officer] shall implement an insider threat program. (PM-12)
- The program shall include a cross-discipline insider threat incident handling team, with members from at least security, human resources, legal and privacy. (PM-12)

##### Federal systems

[Executive Order 13587](https://www.federalregister.gov/documents/2011/10/13/2011-26729/structural-reforms-to-improve-the-security-of-classified-networks-and-the-responsible-sharing-and) (October 7, 2011), section 2.1(b), requires the heads of agencies that operate or access classified computer networks to "implement an insider threat detection and prevention program consistent with guidance and standards developed by the Insider Threat Task Force" that section 6 establishes.

- If the agency operates or accesses classified computer networks, the insider threat program shall meet Executive Order 13587, section 2.1(b), and the guidance and standards of the Insider Threat Task Force. (PM-12)

#### Security and privacy workforce (PM-13)

- The [Chief Information Security Officer] and the [Senior privacy official] shall establish a security and privacy workforce development and improvement program. (PM-13)
- The program shall define the knowledge and skills each security and privacy role needs, and the training and development that build them. (PM-13)

#### Testing, training and monitoring (PM-14)

- The [Chief Information Security Officer] shall maintain a process that ensures the organization's plans for security and privacy testing, training and monitoring of organizational systems are developed and maintained. (PM-14a.1)
- The [Chief Information Security Officer] shall track that those plans continue to be carried out. (PM-14a.2)
- The [Chief Information Security Officer] shall review the testing, training and monitoring plans for consistency with the risk management strategy and the organization-wide priorities for risk response. (PM-14b)

#### Security and privacy groups and associations (PM-15)

- The [Chief Information Security Officer] shall establish and maintain contact with selected security and privacy groups and associations, and record which ones. (PM-15)
- The organization shall use those contacts to support ongoing security and privacy education and training for its personnel. (PM-15a)
- The organization shall use those contacts to stay current with recommended security and privacy practices, techniques and technologies. (PM-15b)
- The organization shall use those contacts to share current security and privacy information, including threats, vulnerabilities and incidents. (PM-15c)

#### Threat awareness program (PM-16)

- The [Chief Information Security Officer] shall implement a threat awareness program. (PM-16)
- The program shall include a capability to share threat intelligence with other organizations. (PM-16)

#### Automated means for sharing threat intelligence (PM-16(1))

- The [Security operations team] shall use automated mechanisms to share threat intelligence, such as machine-readable feeds exchanged with sharing partners. (PM-16(1))

#### Protecting controlled unclassified information on external systems (PM-17)

- The [Chief Information Security Officer] shall establish policy and procedures to ensure that requirements for protecting controlled unclassified information processed, stored or transmitted on external systems are implemented in accordance with applicable laws, regulations, policies and standards. (PM-17a)
- The [Chief Information Security Officer] shall review and update that policy [Fill in: the frequency at which to review and update the policy. Typical: annually]. (PM-17b)
- The [Chief Information Security Officer] shall review and update those procedures [Fill in: the frequency at which to review and update the procedures. Typical: annually]. (PM-17b)

##### Federal systems

Under [32 CFR 2002.14(h)(2)](https://www.ecfr.gov/current/title-32/section-2002.14), agencies must use NIST SP 800-171 when establishing security requirements to protect CUI's confidentiality on non-federal information systems. [32 CFR 2002.2](https://www.ecfr.gov/current/title-32/section-2002.2) still incorporates the June 2015 edition of SP 800-171 by reference, while NIST's current revision is [SP 800-171 Rev. 3](https://csrc.nist.gov/pubs/sp/800/171/r3/final) (May 2024), so each agreement should name the revision it requires. As of October 2026.

- Each agreement that shares CUI with a non-federal organization shall require the recipient to protect it as 32 CFR 2002.14(h) requires, and shall name the revision of NIST SP 800-171 that applies. (PM-17a)

#### Privacy program plan (PM-18)

- The [Senior privacy official] shall develop and disseminate an organization-wide privacy program plan that gives an overview of the privacy program. (PM-18a)
- The plan shall describe the structure of the privacy program and the resources dedicated to it. (PM-18a.1)
- The plan shall give an overview of the requirements for the privacy program, and describe the privacy program management controls and common controls in place or planned to meet them. (PM-18a.2)
- The plan shall include the role of the [Senior privacy official], and identify the roles and responsibilities of other privacy officials and staff. (PM-18a.3)
- The plan shall describe management commitment, compliance, and the strategic goals and objectives of the privacy program. (PM-18a.4)
- The plan shall reflect coordination among the organizational entities responsible for the different aspects of privacy. (PM-18a.5)
- The [Senior leader], as the senior official accountable for the privacy risk the organization incurs, shall approve the plan. (PM-18a.6)
- The [Senior privacy official] shall update the plan [Fill in: the frequency of updates to the privacy program plan. Typical: annually], and to address changes in privacy law and policy, organizational changes, and problems found during plan implementation or privacy control assessments. (PM-18b)

##### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix II, requires each agency to develop, maintain and update an organization-wide privacy program plan.

- The plan shall address the changes in federal privacy laws and policy that apply to the agency. (PM-18b)

#### Privacy program leadership role (PM-19)

- The [Senior leader] shall appoint a [Senior privacy official] with the authority, mission, accountability and resources to coordinate, develop and implement applicable privacy requirements and manage privacy risk through the organization-wide privacy program. (PM-19)
- The [Senior leader] shall record the appointment in writing. (PM-19)

##### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016) requires each agency head to designate a Senior Agency Official for Privacy.

- The [Senior privacy official] shall be the Senior Agency Official for Privacy the agency head designates under OMB Circular A-130. (PM-19)

#### Dissemination of privacy program information (PM-20)

- The [Senior privacy official] shall maintain a privacy webpage on the organization's principal public website as the central source of information about the privacy program. (PM-20)
- The page shall give the public information about the organization's privacy activities and a way to contact the [Senior privacy official]. (PM-20a)
- The page shall make the organization's privacy practices and reports publicly available. (PM-20b)
- The page shall list a public email address or phone line for feedback and questions to the privacy office. (PM-20c)

##### Federal systems

[OMB M-23-22](https://www.whitehouse.gov/wp-content/uploads/2023/09/M-23-22-Delivering-a-Digital-First-Public-Experience.pdf), Delivering a Digital-First Public Experience (September 2023), requires each agency's privacy program page to be located at `www.[agency].gov/privacy`, as of September 2026.

- The privacy webpage shall be located at the address M-23-22 requires, `www.[agency].gov/privacy`. (PM-20)

#### Privacy policies on websites, applications and digital services (PM-20(1))

- The [Senior privacy official] shall ensure a privacy policy is posted on every external-facing website, mobile application and other digital service. (PM-20(1))
- Each privacy policy shall be written in plain language and organized so that it is easy to understand and navigate. (PM-20(1)(a))
- Each privacy policy shall give the public the information it needs to decide whether and how to interact with the organization. (PM-20(1)(b))
- Each privacy policy shall be updated whenever the organization makes a substantive change to the practices it describes, and shall show the date of the latest change. (PM-20(1)(c))

#### Accounting of disclosures (PM-21)

- The [Senior privacy official] shall ensure an accurate accounting is kept of each disclosure of personally identifiable information, recording the date, nature and purpose of the disclosure. (PM-21a.1)
- The accounting shall record the name and address, or other contact information, of the individual or organization that received the disclosure. (PM-21a.2)
- The accounting shall be kept for as long as the personally identifiable information is maintained or five years after the disclosure, whichever is longer. (PM-21b)
- The [Senior privacy official] shall make the accounting available, on request, to the individual the information is about. (PM-21c)

##### Federal systems

For records in a Privacy Act system of records, [5 U.S.C. § 552a(c)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim) sets this accounting. It excludes disclosures to agency employees who need the record for their duties (subsection (b)(1)) and disclosures the Freedom of Information Act requires (subsection (b)(2)). It does not require the accounting to be shown to the individual for law enforcement disclosures under subsection (b)(7).

- The [Senior privacy official] shall keep the accounting of disclosures from each system of records as 5 U.S.C. § 552a(c) requires. (PM-21)

#### Personally identifiable information quality management (PM-22)

- The [Senior privacy official] shall develop and document organization-wide policies and procedures for reviewing personally identifiable information for accuracy, relevance, timeliness and completeness across the information life cycle. (PM-22a)
- The [Senior privacy official] shall develop and document organization-wide policies and procedures for correcting or deleting inaccurate or outdated personally identifiable information. (PM-22b)
- The [Senior privacy official] shall develop and document organization-wide policies and procedures for notifying individuals or other appropriate entities of corrected or deleted personally identifiable information. (PM-22c)
- The [Senior privacy official] shall develop and document organization-wide policies and procedures for appeals of adverse decisions on correction or deletion requests. (PM-22d)

#### Data governance body (PM-23)

- The [Senior leader] shall establish a data governance body made up of [Fill in: the roles of a Data Governance Body. Typical: the chief data officer (chair), the chief information officer, the chief information security officer, the senior privacy official, the records manager and the owners of major data sets], with responsibility for [Fill in: the responsibilities of a Data Governance Body. Typical: setting data governance policy, approving data sharing agreements, and resolving data quality and access issues]. (PM-23)

#### Data integrity board (PM-24)

- Where [Organization name] conducts or takes part in a matching program, the [Senior leader] shall establish a data integrity board. (PM-24)
- The board shall review each proposal to conduct or take part in a matching program before the organization commits to it. (PM-24a)
- The board shall review, each year, every matching program the organization took part in. (PM-24b)

##### Federal systems

The Privacy Act requires every agency that conducts or participates in a matching program to establish a Data Integrity Board, which reviews matching proposals and reviews all of the agency's matching programs each year ([5 U.S.C. § 552a(u)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)).

- The data integrity board shall be established, staffed and run as 5 U.S.C. § 552a(u) requires. (PM-24)

#### Minimization of personally identifiable information used in testing, training and research (PM-25)

- The [Senior privacy official] shall develop, document and implement policies and procedures for using personally identifiable information in internal testing, training and research. (PM-25a)
- Internal testing, training and research shall use no more personally identifiable information than the purpose needs, and shall use synthetic or de-identified data wherever it serves the purpose. (PM-25b)
- The [Senior privacy official] shall authorize each use of personally identifiable information for internal testing, training or research before it begins. (PM-25c)
- The [Senior privacy official] shall review those policies [Fill in: the frequency for reviewing policies that address the use of personally identifiable information for internal testing, training, and research. Typical: annually] and update them [Fill in: the frequency for updating policies that address the use of personally identifiable information for internal testing, training, and research. Typical: annually, and whenever the review finds a change is needed]. (PM-25d)
- The [Senior privacy official] shall review those procedures [Fill in: the frequency for reviewing procedures that address the use of personally identifiable information for internal testing, training, and research. Typical: annually] and update them [Fill in: the frequency for updating procedures that address the use of personally identifiable information for internal testing, training, and research. Typical: annually, and whenever the review finds a change is needed]. (PM-25d)

#### Complaint management (PM-26)

- The [Senior privacy official] shall implement a process for receiving and responding to complaints, concerns and questions from individuals about the organization's security and privacy practices. (PM-26)
- The process shall offer ways to file that are easy to use and readily accessible to the public. (PM-26a)
- The process shall tell individuals all the information they need to file a complaint successfully. (PM-26b)
- The process shall track each complaint so that it is reviewed within [Fill in: the time period in which complaints (including concerns or questions) from individuals are to be reviewed. Typical: 5 business days] and addressed within [Fill in: the time period in which complaints (including concerns or questions) from individuals are to be addressed. Typical: 30 days]. (PM-26c)
- The [Senior privacy official] shall acknowledge receipt of each complaint, concern or question within [Fill in: the time period for acknowledging the receipt of complaints. Typical: 3 business days]. (PM-26d)
- The [Senior privacy official] shall respond to each complaint, concern or question within [Fill in: the time period for responding to complaints. Typical: 30 days]. (PM-26e)

#### Privacy reporting (PM-27)

- The [Senior privacy official] shall develop [Fill in: privacy reports. Typical: an annual privacy program report, summaries of privacy impact assessments, and breach reports]. (PM-27a)
- The [Senior privacy official] shall disseminate the reports to [Fill in: privacy oversight bodies. Typical: the board of directors or its audit committee, and regulators where law requires], to demonstrate accountability with statutory, regulatory and policy privacy mandates. (PM-27a.1)
- The [Senior privacy official] shall disseminate the reports to [Fill in: officials responsible for monitoring privacy program compliance. Typical: the senior leader, the chief information security officer and general counsel] and other personnel responsible for monitoring privacy program compliance. (PM-27a.2)
- The [Senior privacy official] shall review and update the reports [Fill in: the frequency for reviewing and updating privacy reports. Typical: annually]. (PM-27b)

#### Risk framing (PM-28)

- The [Chief Information Security Officer] shall identify and document the assumptions affecting risk assessment, risk response and risk monitoring. (PM-28a.1)
- The [Chief Information Security Officer] shall identify and document the constraints affecting risk assessment, risk response and risk monitoring. (PM-28a.2)
- The [Chief Information Security Officer] shall identify and document the priorities and trade-offs the organization considers in managing risk. (PM-28a.3)
- The [Senior leader] shall set and document the organization's risk tolerance. (PM-28a.4)
- The [Chief Information Security Officer] shall distribute the results of risk framing to [Fill in: the personnel to receive the results of risk framing activities. Typical: authorizing officials, system owners, information owners, the leaders of mission and business functions, the senior privacy official, and the senior accountable official for risk management]. (PM-28b)
- The [Chief Information Security Officer] shall review and update the risk framing [Fill in: the frequency for reviewing and updating risk framing considerations. Typical: annually, with the risk management strategy]. (PM-28c)

#### Risk management program leadership roles (PM-29)

- The [Senior leader] shall appoint a senior accountable official for risk management to align the organization's information security and privacy management processes with its strategic, operational and budgetary planning. (PM-29a)
- The [Senior leader] shall establish a risk executive function to view and analyze risk from an organization-wide perspective and keep risk management consistent across the organization. (PM-29b)

#### Supply chain risk management strategy (PM-30)

- The [Chief Information Security Officer] shall develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance and disposal of systems, system components and system services. (PM-30a)
- The [Chief Information Security Officer] shall implement the supply chain risk management strategy consistently across the organization. (PM-30b)
- The [Chief Information Security Officer] shall review and update the supply chain risk management strategy [Fill in: the frequency for reviewing and updating the supply chain risk management strategy. Typical: annually], and whenever organizational changes require it. (PM-30c)

#### Suppliers of critical or mission-essential items (PM-30(1))

- The [Chief Information Security Officer] shall identify and prioritize the suppliers of critical or mission-essential technologies, products and services. (PM-30(1))
- The [Chief Information Security Officer] shall assess each of those suppliers for supply chain risk. (PM-30(1))

#### Continuous monitoring strategy (PM-31)

- The [Chief Information Security Officer] shall develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that follow it. (PM-31)
- The programs shall monitor these organization-wide metrics: [Fill in: the metrics for organization-wide continuous monitoring. Typical: systems with a current authorization, plan of action items past due, vulnerabilities remediated within the required times, and staff with current security awareness training]. (PM-31a)
- The programs shall monitor control effectiveness [Fill in: the frequencies for monitoring. Typical: continuously for automated controls, and at least monthly for vulnerability, configuration and account data]. (PM-31b)
- The programs shall assess control effectiveness [Fill in: the frequencies for assessing control effectiveness. Typical: a third of each system's controls each year, so every control is assessed at least every three years]. (PM-31b)
- The programs shall monitor the organization-wide metrics on an ongoing basis, as the strategy sets out. (PM-31c)
- The programs shall correlate and analyze the information that control assessments and monitoring produce. (PM-31d)
- The programs shall take response actions to address the results of that analysis. (PM-31e)
- The [Chief Information Security Officer] shall report the security status of organizational systems to [Fill in: the personnel or roles for reporting the security status of organizational systems to. Typical: the senior leader and the authorizing officials] [Fill in: the frequency at which to report the security status of organizational systems. Typical: monthly]. (PM-31f)
- The [Senior privacy official] shall report the privacy status of organizational systems to [Fill in: the personnel or roles for reporting the privacy status of organizational systems to. Typical: the senior leader and the authorizing officials] [Fill in: the frequency at which to report the privacy status of organizational systems. Typical: quarterly]. (PM-31f)

#### Purposing (PM-32)

- The [Chief Information Security Officer] shall analyze [Fill in: the systems or system components supporting mission-essential services or functions. Typical: the systems and components that support mission-essential functions, as the business impact analysis identifies them] to ensure their information resources are used consistently with their intended purpose. (PM-32)

### Personnel Security (PS)

#### Access agreements (PS-6)

- The [Chief Information Security Officer] shall develop and document access agreements for organizational systems. (PS-6a)
- The [Chief Information Security Officer] shall review and update the access agreements [Fill in: the frequency at which to review and update access agreements. Typical: annually]. (PS-6b)
- The [Account manager] shall verify that each individual who requires access to organizational information and systems has signed the appropriate access agreements before granting access. (PS-6c.1)
- The [Account manager] shall verify that each individual re-signs the access agreements when they are updated, and [Fill in: the frequency at which to re-sign access agreements to maintain access to organizational information. Typical: annually], to keep access to organizational systems. (PS-6c.2)
- The [Account manager] shall suspend the access of an individual who does not re-sign an updated access agreement until the individual signs it. (PS-6c.2)

### Personally Identifiable Information Processing and Transparency (PT)

#### Authority to process personally identifiable information (PT-2)

- The [System owner] shall determine and document [Fill in: the authority to permit the processing of personally identifiable information. Typical: the law, regulation, contract or consent] that permits [Fill in: the type of processing of personally identifiable information. Typical: each collection, use, sharing, retention and disposal] of personally identifiable information by the system, and record it in the system's privacy impact assessment. (PT-2a)
- The [Senior privacy official] shall confirm the authority with legal counsel before any new processing of personally identifiable information begins. (PT-2a)
- The [System owner] shall restrict [Fill in: the type of processing of personally identifiable information to be restricted. Typical: all processing] of personally identifiable information to only that which is authorized. (PT-2b)

##### Federal systems

The Privacy Act of 1974 requires each agency to "maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by executive order of the President" ([5 U.S.C. § 552a(e)(1)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)), and forbids disclosing a record in a system of records without the individual's written request or prior written consent, except under the conditions in [subsection (b)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim). [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016), Appendix II, section 5.b, requires agencies to limit the creation, collection, use, processing, storage, maintenance, dissemination and disclosure of personally identifiable information to that which is legally authorized, relevant, and reasonably deemed necessary for the proper performance of agency functions. As of September 2026.

- The [System owner] shall record, for each system, the statute or executive order that authorizes the processing. (PT-2a)
- The [System owner] shall ensure records in a system of records are disclosed only with the individual's written request or prior written consent, or under a condition of 5 U.S.C. § 552a(b). (PT-2b)

#### Personally identifiable information processing purposes (PT-3)

- The [System owner] shall identify [Fill in: the purpose(s) for processing personally identifiable information. Typical: the specific, explicit purposes of the system or program] for processing personally identifiable information, and document them in the system's privacy impact assessment. (PT-3a)
- The [Senior privacy official] shall ensure the purposes are described in the organization's public privacy notices and policies. (PT-3b)
- The [System owner] shall restrict [Fill in: the processing of personally identifiable information to be restricted. Typical: all use, sharing and retention] of personally identifiable information to only that which is compatible with the identified purposes. (PT-3c)
- The [System owner] shall monitor changes in the processing of personally identifiable information. (PT-3d)
- The [System owner] shall implement [Fill in: mechanisms to be implemented for ensuring any changes in the processing of personally identifiable information are made in accordance with requirements. Typical: a privacy review of each proposed change through change control, with an updated privacy impact assessment (CM-3, CM-4, RA-8)] to ensure any change in processing is made in accordance with [Fill in: requirements for changing the processing of personally identifiable information. Typical: approval by the senior privacy official, an updated privacy notice before the change takes effect, and the consent of individuals where the new purpose is not compatible with the original one]. (PT-3d)

##### Federal systems

Under the Privacy Act, a routine use is "the use of such record for a purpose which is compatible with the purpose for which it was collected" ([5 U.S.C. § 552a(a)(7)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)), and each system of records notice lists the routine uses and their purposes ([subsection (e)(4)(D)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). A new or changed routine use needs Federal Register notice and a chance for public comment at least 30 days before publication under paragraph (4)(D) ([subsection (e)(11)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). As of September 2026.

- The [Senior privacy official] shall ensure a new or changed purpose for records in a system of records is published as a routine use, with the notice and comment period 5 U.S.C. § 552a(e)(11) requires, before records are disclosed for it. (PT-3d)

#### Consent (PT-4)

- The [Senior privacy official] shall ensure [Fill in: the tools or mechanisms to be implemented for individuals to consent to the processing of their personally identifiable information. Typical: opt-in consent forms and settings that record the date and the version of the notice shown, and let individuals withdraw consent as easily as they gave it] are implemented for individuals to consent to the processing of their personally identifiable information before it is collected. (PT-4)
- Each request for consent shall use plain language and explain what will be processed, for what purpose and with whom it will be shared, so that individuals can make an informed decision. (PT-4)
- The [System owner] shall keep a record of each consent given and withdrawn. (PT-4)

#### Privacy notice (PT-5)

- The [Senior privacy official] shall ensure individuals are given notice about the processing of their personally identifiable information. (PT-5)
- The notice shall be available to individuals when they first interact with the organization, and again at [Fill in: the frequency at which a notice is provided to individuals after initial interaction with an organization. Typical: each later collection of personally identifiable information, and whenever the notice changes materially]. (PT-5a)
- The notice shall be clear and easy to understand, expressing information about the processing of personally identifiable information in plain language. (PT-5b)
- The notice shall identify the authority that authorizes the processing of personally identifiable information. (PT-5c)
- The notice shall identify the purposes for which personally identifiable information is to be processed. (PT-5d)
- The notice shall include [Fill in: information to be included with the notice about the processing of personally identifiable information. Typical: what information is collected, with whom it is shared, the choices individuals have and how to exercise them, how individuals can access and correct their information, how long it is kept, how it is protected, and how to contact the privacy office]. (PT-5e)
- The [Senior privacy official] shall approve each privacy notice, and each change to one, before it is published. (PT-5)

##### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016), Appendix II, section 5.a, requires agencies to maintain and post privacy policies on all agency websites, mobile applications and other digital services, in accordance with the E-Government Act and OMB policy. [Section 208(c) of the E-Government Act of 2002](https://www.congress.gov/107/plaws/publ347/PLAW-107publ347.htm) (Pub. L. 107-347) directs OMB to issue guidance under which a privacy notice on an agency website addresses what information is collected, why, the intended use, with whom it will be shared, what notice or opportunities for consent individuals have, how it will be secured, and the rights of the individual under the Privacy Act and other privacy laws. As of September 2026.
<!-- TODO(verify): OMB M-03-22 (September 2003) is the guidance issued under section 208(c), but no primary source seen here confirms it is still in effect; cite it only once confirmed. -->

- The [Senior privacy official] shall maintain and post a privacy policy on every agency website, mobile application and other digital service, as OMB Circular A-130, Appendix II, requires. (PT-5)
- Each website privacy notice shall address the elements section 208(c)(1)(B) of the E-Government Act lists. (PT-5e)

#### Privacy Act statements (PT-5(2))

- Where a form collects information that will be maintained in a Privacy Act system of records, the [System owner] shall include a Privacy Act statement on the form, or provide it on a separate form that the individual can keep. (PT-5(2))
- The [Senior privacy official] shall approve each Privacy Act statement before the form is used. (PT-5(2))

##### Federal systems

The Privacy Act requires each agency to tell every individual it asks to supply information, on the collection form or on a separate form the individual can keep, the authority for the request and whether disclosure is mandatory or voluntary, the principal purposes, the routine uses, and the effects of not providing the information ([5 U.S.C. § 552a(e)(3)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). [OMB Circular A-108](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf) (reissued December 23, 2016, 81 FR 94424), section 6.l, adds a citation to the system of records notice, requires the statement whatever the medium (paper, electronic form, website, mobile application or telephone), and, for collection by telephone, requires the information to be given orally with a way to receive it in writing. As of September 2026.

- Each Privacy Act statement shall describe, in plain language, the authority for the request and whether disclosure is mandatory or voluntary, the principal purposes, the routine uses, and the effects on the individual of not providing all or part of the information. (PT-5(2))
- Each Privacy Act statement shall cite, and link where practicable, the system of records notice for the records. (PT-5(2))
- The [System owner] shall provide the Privacy Act statement whatever the medium of collection, and, for collection by telephone, give it orally with a way for the individual to receive it in writing. (PT-5(2))

#### System of records notice (PT-6)

- For each system that processes information to be maintained in a Privacy Act system of records, the [Senior privacy official] shall draft the system of records notice in accordance with OMB guidance. (PT-6a)
- The [Senior privacy official] shall submit each new or significantly modified system of records notice to OMB and the appropriate congressional committees for advance review. (PT-6a)
- The [Senior privacy official] shall publish each system of records notice in the Federal Register. (PT-6b)
- The [Senior privacy official] shall keep each system of records notice accurate, up to date and scoped in accordance with policy. (PT-6c)
- The [System owner] shall tell the [Senior privacy official] of any change to the system that could affect its system of records notice before the change is made. (PT-6c)

##### Federal systems

The Privacy Act requires an agency to publish a notice in the Federal Register when it establishes or revises a system of records ([5 U.S.C. § 552a(e)(4)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)), to give at least 30 days' notice, with a chance for comment, of any new use of the information ([subsection (e)(11)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)), and to give OMB and the congressional committees advance notice of a proposal to establish or significantly change a system of records ([subsection (r)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). [OMB Circular A-108](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf) (reissued December 23, 2016) sets how: a notice drafted with the Office of the Federal Register templates in its Appendices II and III (section 6.c); a report to OMB and Congress at least 30 days before the notice is submitted for publication, with OMB's 30-day review not running at the same time as the Federal Register publication period (section 7.b); a notice of rescindment when the agency stops maintaining the system (section 6.f); and a list of, and links to, every notice on the agency's privacy page (section 15.a). [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix II, section 5.a, requires agencies to ensure notices are published, revised and rescinded as required. As of September 2026.

- The [Senior privacy official] shall draft each system of records notice with the Office of the Federal Register template in OMB Circular A-108. (PT-6a)
- The [Senior privacy official] shall report each proposal to establish or significantly modify a system of records to OMB and Congress at least 30 days before submitting the notice to the Federal Register. (PT-6a)
- The [Senior privacy official] shall not use a new or significantly modified routine use as the basis for a disclosure until at least 30 days after its Federal Register publication. (PT-6b)
- The [Senior privacy official] shall publish a notice of rescindment when the agency stops maintaining a system of records. (PT-6c)
- The [Senior privacy official] shall list and link every current system of records notice on the agency's privacy program page. (PT-6c)

#### Routine uses (PT-6(1))

- The [Senior privacy official] shall review all routine uses published in each system of records notice [Fill in: the frequency at which to review all routine uses published in the system of records notice. Typical: annually] to ensure they remain accurate and compatible with the purpose for which the information was collected. (PT-6(1))

##### Federal systems

[OMB Circular A-108](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf), section 12, requires the privacy controls for a system of records to ensure that all routine uses remain appropriate and that the recipient's use stays compatible with the purpose of collection (12.c). It also records that the agency-wide privacy continuous monitoring program replaced the earlier OMB requirement for annual Privacy Act reviews, so the review frequency is the one the agency's privacy continuous monitoring strategy assigns. As of September 2026.

- The [Senior privacy official] shall review routine uses at the frequency the agency's privacy continuous monitoring strategy sets for this control. (PT-6(1))

#### Exemption rules (PT-6(2))

- The [Senior privacy official] shall review all Privacy Act exemptions claimed for each system of records [Fill in: the frequency at which to review all Privacy Act exemptions claimed for the system of records. Typical: annually] to ensure they remain appropriate and necessary in accordance with law, have been promulgated as regulations, and are accurately described in the system of records notice. (PT-6(2))

##### Federal systems

The Privacy Act allows exemptions only by rules issued under the rulemaking procedures of 5 U.S.C. § 553, stating the reasons for each ([5 U.S.C. § 552a(j) and (k)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). [OMB Circular A-108](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf), section 11, requires each exemption rule to name the system, the provisions exempted and the reasons, and to explain why the exemption is necessary and appropriate, and requires the exemption to be identified in the system of records notice; section 12.d requires the privacy controls to ensure each claimed exemption remains appropriate and necessary. As of September 2026.

- The [Senior privacy official] shall ensure each exemption claimed for a system of records is issued as a rule under 5 U.S.C. § 553 and identified in the system of records notice, as OMB Circular A-108, section 11, requires. (PT-6(2))

#### Specific categories of personally identifiable information (PT-7)

- The [Senior privacy official] shall designate the categories of personally identifiable information that need specific processing conditions, such as Social Security numbers, health, financial and biometric information, and information about children. (PT-7)
- The [System owner] shall apply [Fill in: processing conditions to be applied for specific categories of personally identifiable information. Typical: the conditions the senior privacy official sets for each designated category, such as collection only where law requires it or a documented need exists, encryption, and access limited to named roles] to the designated categories of personally identifiable information. (PT-7)

#### Social Security numbers (PT-7(1))

- When a system processes Social Security numbers, the [System owner] shall eliminate their unnecessary collection, maintenance and use, and explore alternatives to their use as a personal identifier. (PT-7(1)(a))
- The [System owner] shall ensure no individual is denied any right, benefit or privilege provided by law because the individual refuses to disclose their Social Security number. (PT-7(1)(b))
- The [System owner] shall inform each individual asked to disclose their Social Security number whether disclosure is mandatory or voluntary, by what statutory or other authority the number is requested, and what uses will be made of it. (PT-7(1)(c))

##### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016), Appendix II, section 5.b, requires agencies to take steps to eliminate unnecessary collection, maintenance and use of Social Security numbers, and to explore alternatives to their use as a personal identifier. Section 7 of the [Privacy Act of 1974](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim) (in the notes to 5 U.S.C. § 552a) sets the rules in PT-7(1)(b) and (c) for federal, state and local government agencies. As of September 2026.

- The [Senior privacy official] shall review the agency's collection and use of Social Security numbers and record the steps taken to eliminate unnecessary uses, as OMB Circular A-130, Appendix II, requires. (PT-7(1)(a))

#### First Amendment information (PT-7(2))

- The [System owner] shall not process information describing how any individual exercises rights guaranteed by the First Amendment, unless expressly authorized by statute or by the individual, or unless pertinent to and within the scope of an authorized law enforcement activity. (PT-7(2))

##### Federal systems

The Privacy Act requires each agency to "maintain no record describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity" ([5 U.S.C. § 552a(e)(7)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). The general exemptions in subsection (j) cannot remove this requirement. As of September 2026.

- The [Senior privacy official] shall ensure no system of records holds a record of how an individual exercises First Amendment rights except as 5 U.S.C. § 552a(e)(7) allows. (PT-7(2))

#### Computer matching requirements (PT-8)

- Where a system or the organization processes information to conduct a matching program, the [Senior privacy official] shall obtain the approval of the data integrity board before the program begins. (PT-8a)
- The [Senior privacy official] shall develop and enter into a computer matching agreement for each matching program. (PT-8b)
- The [Senior privacy official] shall publish a matching notice in the Federal Register for each matching program. (PT-8c)
- The [System owner] shall independently verify the information a matching program produces before any adverse action is taken against an individual, where verification is required. (PT-8d)
- The [System owner] shall give each individual notice and an opportunity to contest the findings before any adverse action is taken against them. (PT-8e)

##### Federal systems

The Privacy Act ([5 U.S.C. § 552a](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)) requires a written matching agreement stating, among other things, the purpose and legal authority, the justification and expected results, the records and data elements matched, and the verification, retention, security and redisclosure rules (subsection (o)(1)); the agreement takes effect 30 days after it is sent to the congressional committees, lasts no more than 18 months, and may be renewed once for up to one year (subsection (o)(2)); after that, the program continues only if it is re-established, with a new matching notice and report ([OMB Circular A-108](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf), section 8 and footnote 72). The data integrity board approves each agreement (subsection (u)(3)(A)). A matching notice is published in the Federal Register at least 30 days before the program is conducted (subsection (e)(12)), and OMB and Congress get advance notice (subsection (r)). No adverse action may follow until the information is independently verified, or the board makes the determination subsection (p)(1)(A)(ii) allows, and the individual has been notified and has had the period set by statute or regulation, or else 30 days, to respond (subsection (p)). [OMB Circular A-108](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A108/omb_circular_a-108.pdf), sections 8 and 9, sets how matching notices are published and reported. As of October 2026.

- Each computer matching agreement shall contain every element 5 U.S.C. § 552a(o)(1) lists, and be sent to the congressional committees at least 30 days before it takes effect. (PT-8b)
- The data integrity board shall set each agreement's term at no more than 18 months, and renew it no more than once, for up to one year, as 5 U.S.C. § 552a(o)(2)(D) and OMB Circular A-108, section 8, allow. (PT-8b)
- The [Senior privacy official] shall publish the matching notice at least 30 days before the matching program is conducted. (PT-8c)
- The [System owner] shall allow the individual the period set by statute or regulation, or else 30 days from the notice, to respond before taking adverse action. (PT-8e)

### Risk Assessment (RA)

#### Risk assessment (RA-3)

- Each [System owner] shall conduct a risk assessment of the system that identifies threats to and vulnerabilities in the system. (RA-3a.1)
- The risk assessment shall determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification or destruction of the system, the information it processes, stores or transmits, and any related information. (RA-3a.2)
- For a system that processes personally identifiable information, the risk assessment shall determine the likelihood and impact of adverse effects on individuals arising from that processing. (RA-3a.3)
- The [System owner] shall integrate the organization's risk management strategy, risk framing and mission or business process risk decisions into the system risk assessment. (RA-3b)
- The [System owner] shall document the risk assessment results in the [Select one: security and privacy plans; risk assessment report; [Assignment: organization-defined document]. Typical: risk assessment report]. (RA-3c)
- The [System owner] shall review the risk assessment results [Fill in: the frequency to review risk assessment results. Typical: annually]. (RA-3d)
- The [System owner] shall share the risk assessment results with [Fill in: personnel or roles to whom risk assessment results are to be disseminated. Typical: the authorizing official, the system owner and the Chief Information Security Officer]. (RA-3e)
- The [System owner] shall update the risk assessment [Fill in: the frequency to update the risk assessment. Typical: at least every three years], and whenever there are significant changes to the system, its environment of operation, or other conditions that may affect its security or privacy state. (RA-3f)

#### Risk response (RA-7)

- Each [System owner] shall respond to findings from security and privacy assessments, monitoring and audits in accordance with the organizational risk tolerance set in the risk management strategy. (RA-7)
- The [System owner] shall record each response as a remediation, a plan of action and milestones item, or a risk acceptance. (RA-7)
- A risk to an authorized system shall be accepted only by its authorizing official, after consulting the roles the risk management strategy names for that risk level. (RA-7)

#### Privacy impact assessments (RA-8)

- The [System owner] shall have a privacy impact assessment conducted before developing or procuring information technology that processes personally identifiable information. (RA-8a)
- The [System owner] shall have a privacy impact assessment conducted before initiating a new collection of personally identifiable information that will be processed using information technology. (RA-8b)
- The [Senior privacy official] shall review and approve each privacy impact assessment. (RA-8)
- The [System owner] shall update the privacy impact assessment when a change to the system or the processing creates new privacy risks. (RA-8)

##### Federal systems

[Section 208(b) of the E-Government Act of 2002](https://www.congress.gov/107/plaws/publ347/PLAW-107publ347.htm) (Pub. L. 107-347) requires agencies to conduct a privacy impact assessment before developing or procuring information technology that collects, maintains or disseminates information in identifiable form, and before initiating a new collection of such information that uses information technology and poses identical questions to 10 or more persons other than agencies, instrumentalities or employees of the Federal Government. The Chief Information Officer, or an equivalent official the agency head names, reviews each assessment, which is then made public where practicable. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016), Appendix II, carries the requirement into agency privacy programs.

- The [System owner] shall have a privacy impact assessment conducted whenever section 208(b) of the E-Government Act of 2002 requires one. (RA-8)
- The [Senior privacy official] shall make each privacy impact assessment publicly available, where practicable, as section 208(b) requires. (RA-8)

### System and Services Acquisition (SA)

#### Allocation of resources (SA-2)

- The [System owner] shall determine the high-level information security and privacy requirements for the system or system service during mission and business process planning, before an acquisition or development begins. (SA-2a)
- The [System owner] shall determine and document the resources required to protect the system or system service, including acquisition, sustainment and supply chain risk management costs across the system development life cycle, as part of the organization's capital planning and investment control process. (SA-2b)
- The [Senior leader] shall allocate the documented resources through the capital planning and investment control process, and record the reason for any shortfall. (SA-2b)
- The [Chief Information Security Officer] and the [Senior privacy official] shall ensure a discrete line item for information security and a discrete line item for privacy are established in the organization's programming and budgeting documentation for the system. (SA-2c)

##### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.b(1) to (3), requires agencies to identify and plan for the resources needed to implement information security and privacy programs; to ensure that security and privacy are addressed throughout the life cycle of each agency information system, with security and privacy activities and costs identified and included in IT investment capital plans and budgetary requests; and to plan and budget to upgrade, replace or retire any system for which protections commensurate with risk cannot be effectively implemented. Section 4.e(6) requires the Senior Agency Official for Privacy to review IT capital investment plans and budgetary requests so that privacy requirements, and their costs, are explicitly identified and included. As of September 2026.

- The [System owner] shall identify the system's security and privacy activities and costs in its IT investment capital plan and budgetary requests, as OMB Circular A-130, Appendix I, section 4.b(2), requires. (SA-2b)
- For a system that processes personally identifiable information, the [Senior privacy official] shall review the system's IT capital investment plan and budgetary requests to confirm that privacy requirements and their costs are explicitly identified and included, as OMB Circular A-130, Appendix I, section 4.e(6), requires. (SA-2c)

#### System development life cycle (SA-3)

- The [System owner] shall acquire, develop and manage the system using [Fill in: system development life cycle. Typical: the organization's documented system development life cycle, with security and privacy activities and a review gate in each phase: initiation, development or acquisition, implementation and assessment, operations and maintenance, and disposal] that incorporates information security and privacy considerations. (SA-3a)
- The [Chief Information Security Officer] and the [Senior privacy official] shall define and document the information security and privacy roles and responsibilities for each phase of the system development life cycle. (SA-3b)
- The [System owner] shall identify, in the system security plan, the individuals who hold information security and privacy roles and responsibilities for the system. (SA-3c)
- The [System owner] shall integrate the organization's information security and privacy risk management process into the system development life cycle, so that categorization, control selection, implementation, assessment, authorization and monitoring take place in the phases the risk management process assigns them to. (SA-3d)

##### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.b(2), requires agencies to ensure that information security and privacy are addressed throughout the life cycle of each agency information system. As of September 2026.

- The [System owner] shall ensure information security and privacy are addressed in every phase of the system's life cycle, from planning and acquisition through operation, maintenance and disposal, as OMB Circular A-130, Appendix I, section 4.b(2), requires. (SA-3a)

#### Acquisition process (SA-4)

- The [System owner] shall include the following requirements, descriptions and criteria, explicitly or by reference, using [Select one or more: standardized contract language; [Assignment: organization-defined contract language]. Typical: standardized contract language that the procurement office maintains and the Chief Information Security Officer and senior privacy official approve, with system-specific requirements added for each acquisition], in the acquisition contract for each system, system component or system service. (SA-4)
- The contract shall state the security and privacy functional requirements. (SA-4a)
- The contract shall state the strength of mechanism requirements, such as resistance to tampering, bypass and direct attack. (SA-4b)
- The contract shall state the security and privacy assurance requirements, including the development processes and the evidence from development and assessment that the supplier provides. (SA-4c)
- The contract shall state the controls needed to satisfy the security and privacy requirements, with any control parameter values the supplier must meet. (SA-4d)
- The contract shall state the security and privacy documentation requirements (SA-5). (SA-4e)
- The contract shall state the requirements for protecting security and privacy documentation. (SA-4f)
- The contract shall describe the system development environment and the environment in which the system is intended to operate. (SA-4g)
- The contract shall allocate responsibility for, or identify the parties responsible for, information security, privacy and supply chain risk management. (SA-4h)
- The contract shall state the acceptance criteria for the system, component or service. (SA-4i)
- The [Chief Information Security Officer] shall review each solicitation for a system, system component or system service for these requirements before it is issued, and the [Senior privacy official] shall review each one for a system that processes personally identifiable information. (SA-4)

##### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.j(1), requires agencies to ensure that the terms and conditions of contracts and other agreements involving Federal information incorporate security and privacy requirements sufficient to meet Federal and agency-specific requirements for its protection; section 4.j(5) requires them to include provisions for Federal Government notification and access, and for cooperation with agency personnel and Inspectors General. [OMB M-26-05](https://www.whitehouse.gov/wp-content/uploads/2026/01/M-26-05-Adopting-a-Risk-based-Approach-to-Software-and-Hardware-Security.pdf), Adopting a Risk-based Approach to Software and Hardware Security (January 23, 2026), rescinds M-22-18 and M-23-16, so agencies are no longer required to collect the Secure Software Development Attestation Form. It requires agencies to develop software and hardware assurance policies and processes that match their risk determinations, and lets them use the attestation form, and contract terms requiring a current software bill of materials on request, where they choose to. As of September 2026.

- The [System owner] shall ensure each contract or agreement involving Federal information incorporates the security and privacy requirements that apply to that information, and provisions for Federal Government notification and access and for cooperation with agency personnel and the Inspector General, as OMB Circular A-130, Appendix I, sections 4.j(1) and 4.j(5), require. (SA-4)
- The [Chief Information Security Officer] shall decide, for each acquisition of software or hardware and based on a risk assessment, whether to require a secure software development attestation or a software bill of materials, following the agency's assurance policy under OMB M-26-05. (SA-4c)

<!-- TODO(verify): FAR contract requirements for IT security. The FAR as codified on acquisition.gov (FAC 2026-01, effective March 13, 2026) has 39.101(c), requiring agencies to include the appropriate information technology security policies and requirements, including use of common security configurations from NIST, in IT acquisitions, and the 52.239-1 clause at 39.106. Many agencies (for example GSA, Treasury, DOL and HUD) have issued Revolutionary FAR Overhaul class deviations for Part 39, and whether the deviation text keeps these requirements was not confirmed on 2026-09-29. Cite the FAR here once it is clear which text governs. -->

#### Minimization (SA-8(33))

- For a system that processes personally identifiable information, the [System owner] shall implement the privacy principle of minimization using [Fill in: processes that implement the privacy principle of minimization. Typical: the minimization review in the system's privacy impact assessment, which lists the data elements needed for each stated purpose and those left out, and the retention periods and disposal steps set under SI-12]. (SA-8(33))
- The [Senior privacy official] shall review the minimization decisions for each new system, and for each change that adds personally identifiable information or a new purpose, before the change is approved. (SA-8(33))

##### Federal systems

The Privacy Act requires each agency that maintains a system of records to "maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by executive order of the President" ([5 U.S.C. § 552a(e)(1)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). As of September 2026.

- For a system that contains a Privacy Act system of records, the [System owner] shall design the system to maintain only the information about individuals that is relevant and necessary to a purpose of the agency required by statute or executive order, as 5 U.S.C. § 552a(e)(1) requires. (SA-8(33))

#### External system services (SA-9)

- The [System owner] shall require that providers of external system services comply with the organization's security and privacy requirements and employ [Fill in: controls to be employed by external system service providers. Typical: the controls of the system's baseline that the provider is responsible for, per the shared responsibility matrix, with evidence from an independent attestation]. (SA-9a)
- The [System owner] shall record those requirements in the contract or service agreement before the service is used. (SA-9a)
- The [System owner] shall define and document the organization's oversight roles and responsibilities, and the user roles and responsibilities, for each external system service, including a shared responsibility matrix. (SA-9b)
- The [System owner] shall employ [Fill in: processes, methods, and techniques employed to monitor control compliance by external service providers. Typical: annual review of independent attestation reports, review of the provider's continuous monitoring or status reports, and contract service reviews] to monitor the provider's control compliance on an ongoing basis. (SA-9c)
- The [System owner] shall follow up each exception in a provider's attestation report, and each customer control the report expects the organization to operate, and record weaknesses that affect the system in its plan of action and milestones (CA-5). (SA-9c)

##### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.j(2)(a) and (b), requires agencies to provide oversight of information systems used or operated by contractors or other entities on behalf of the Federal Government, including documented oversight policies and procedures and ensuring that the security and privacy controls of those systems and services are effectively implemented and comply with NIST standards and guidelines and agency requirements. Under [OMB M-24-15](https://www.fedramp.gov/2026/authority/m-24-15/), Modernizing the Federal Risk and Authorization Management Program (July 25, 2024), agencies must obtain and maintain a FedRAMP authorization for cloud products and services that create, collect, process, store or maintain federal information on the agency's behalf, unless the memo places them out of scope. As of September 2026.

- The [System owner] shall ensure each cloud product or service within the scope of OMB M-24-15 has a FedRAMP authorization before it processes federal information, and that the agency issues its own authorization to use it. (SA-9a)
- The [System owner] shall document the agency's oversight of each system a contractor or other entity operates on its behalf, and verify that its controls are effectively implemented, as OMB Circular A-130, Appendix I, section 4.j(2), requires. (SA-9c)

#### Developer testing and evaluation (SA-11)

- The [System owner] shall require the developer of the system, system component or system service, at all post-design stages of the system development life cycle, to develop and implement a plan for ongoing security and privacy control assessments. (SA-11a)
- The [System owner] shall require the developer to perform [Select one or more: unit; integration; system; regression. Typical: unit, integration, system and regression] testing and evaluation [Fill in: frequency at which to conduct the selected unit, integration, system or regression testing/evaluation. Typical: with each build for automated tests, and before each release to production for system and regression testing] at [Fill in: depth and coverage of the selected unit, integration, system or regression testing/evaluation. Typical: static analysis of all custom code, analysis of third-party and open-source components for known vulnerabilities, dynamic testing of every externally reachable interface, and a test for each security and privacy requirement]. (SA-11b)
- The [System owner] shall require the developer to produce evidence of the execution of the assessment plan and of the results of the testing and evaluation. (SA-11c)
- The [System owner] shall require the developer to implement a verifiable flaw remediation process. (SA-11d)
- The [System owner] shall require the developer to correct flaws identified during testing and evaluation, and shall not accept a release with an unresolved flaw unless the risk is accepted (RA-7). (SA-11e)
- For a system that processes personally identifiable information, the [System owner] shall ensure the developer's tests use test data prepared under SI-12(2), not live personally identifiable information, unless the [Senior privacy official] approves otherwise. (SA-11b)

### System and Communications Protection (SC)

#### Personally identifiable information (SC-7(24))

- For a system that processes personally identifiable information, the [System owner] shall apply [Fill in: processing rules for systems that process personally identifiable information. Typical: the permitted purposes, recipients and data elements for each flow of personally identifiable information, as set out in the system's privacy impact assessment] to its data elements of personally identifiable information. (SC-7(24)(a))
- For such a system, the [System owner] shall monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system. (SC-7(24)(b))
- For such a system, the [System owner] shall document each processing exception. (SC-7(24)(c))
- For such a system, the [System owner] shall review processing exceptions and remove those that are no longer supported. (SC-7(24)(d))

### System and Information Integrity (SI)

#### Information management and retention (SI-12)

- The [System owner] shall manage and retain information within the system, and information output from the system, in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements. (SI-12)
- The [System owner] shall document the retention period and the authority for it for each type of information the system holds, drawn from the organization's records retention schedule. (SI-12)
- The [System owner] shall dispose of information when its retention period ends, unless a legal hold or an approved extension applies. (SI-12)

##### Federal systems

The head of each federal agency must "make and preserve records containing adequate and proper documentation" of the agency's functions ([44 U.S.C. § 3101](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3101&num=0&edition=prelim)), and federal records "may not be alienated or destroyed" except under chapter 33 of title 44 ([44 U.S.C. § 3314](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3314&num=0&edition=prelim)): that is, under records schedules approved by the Archivist of the United States, including the General Records Schedules the Archivist issues for records common to several or all agencies ([44 U.S.C. § 3303a(d)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3303a&num=0&edition=prelim)). As of September 2026.

- The [System owner] shall retain and dispose of federal records in the system only as an approved agency records schedule or a General Records Schedule allows. (SI-12)

#### Limit personally identifiable information elements (SI-12(1))

- For a system that processes personally identifiable information, the [System owner] shall limit the personally identifiable information processed in the information life cycle to [Fill in: elements of personally identifiable information being processed in the information life cycle. Typical: the data elements the system's privacy impact assessment lists as needed for its stated purposes]. (SI-12(1))

#### Minimize personally identifiable information in testing, training and research (SI-12(2))

- The [System owner] shall use the following techniques to minimize the use of personally identifiable information for research: [Fill in: techniques used to minimize the use of personally identifiable information for research. Typical: de-identified or synthetic data, or where the research needs identifiable data, only the elements the senior privacy official approves]. (SI-12(2))
- The [System owner] shall use the following techniques to minimize the use of personally identifiable information for testing: [Fill in: techniques used to minimize the use of personally identifiable information for testing. Typical: synthetic data, or masked copies of production data]. (SI-12(2))
- The [System owner] shall use the following techniques to minimize the use of personally identifiable information for training: [Fill in: techniques used to minimize the use of personally identifiable information for training. Typical: fictitious or synthetic records]. (SI-12(2))

#### Information disposal (SI-12(3))

- The [System owner] shall use the following techniques to dispose of information following the retention period: [Fill in: techniques used to dispose of information following the retention period. Typical: deletion by the system's automated retention jobs, and shredding for paper output]. (SI-12(3))
- The [System owner] shall use the following techniques to destroy information following the retention period: [Fill in: techniques used to destroy information following the retention period. Typical: destruction of storage media by shredding, disintegration or incineration, as the media sanitization procedure sets out]. (SI-12(3))
- The [System owner] shall use the following techniques to erase information following the retention period: [Fill in: techniques used to erase information following the retention period. Typical: cryptographic erase or overwriting, as the media sanitization procedure sets out]. (SI-12(3))

#### Personally identifiable information quality operations (SI-18)

- For a system that processes personally identifiable information, the [System owner] shall check the accuracy of the personally identifiable information across the information life cycle [Fill in: the frequency at which to check the accuracy of personally identifiable information across the information life cycle. Typical: at collection, and at least annually]. (SI-18a)
- For such a system, the [System owner] shall check the relevance of the personally identifiable information across the information life cycle [Fill in: the frequency at which to check the relevance of personally identifiable information across the information life cycle. Typical: at least annually, with the review of the privacy impact assessment]. (SI-18a)
- For such a system, the [System owner] shall check the timeliness of the personally identifiable information across the information life cycle [Fill in: the frequency at which to check the timeliness of personally identifiable information across the information life cycle. Typical: at least annually]. (SI-18a)
- For such a system, the [System owner] shall check the completeness of the personally identifiable information across the information life cycle [Fill in: the frequency at which to check the completeness of personally identifiable information across the information life cycle. Typical: at collection, and at least annually]. (SI-18a)
- For such a system, the [System owner] shall correct or delete inaccurate or outdated personally identifiable information. (SI-18b)

##### Federal systems

The Privacy Act requires each agency that maintains a system of records to maintain all records used in making any determination about an individual "with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination", and, before disseminating a record to anyone other than an agency (except under subsection (b)(2)), to make reasonable efforts to assure it is accurate, complete, timely and relevant for agency purposes ([5 U.S.C. § 552a(e)(5) and (e)(6)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). As of September 2026.

- For each system of records, the [System owner] shall maintain records used in making determinations about individuals with the accuracy, relevance, timeliness and completeness 5 U.S.C. § 552a(e)(5) requires. (SI-18a)
- Before disseminating a record from a system of records to anyone other than an agency, except under 5 U.S.C. § 552a(b)(2), the [System owner] shall make reasonable efforts to assure the record is accurate, complete, timely and relevant for agency purposes. (SI-18a)

#### Individual requests (SI-18(4))

- For a system that processes personally identifiable information, the [System owner] shall correct or delete personally identifiable information upon request by individuals or their designated representatives, once the request is verified and approved. (SI-18(4))
- The [Senior privacy official] shall ensure each request to correct or delete personally identifiable information is answered, and that a refusal is given in writing with the reason and how to appeal. (SI-18(4))

##### Federal systems

For records in a system of records, the Privacy Act lets an individual request amendment of a record about them. The agency must acknowledge the request in writing "not later than 10 days (excluding Saturdays, Sundays, and legal public holidays)" after receiving it, and then promptly either make the correction or tell the individual of its refusal, the reasons, and how to request a review. A review of a refusal must be completed within 30 days, excluding Saturdays, Sundays and legal public holidays, unless the agency head extends the period for good cause ([5 U.S.C. § 552a(d)(2) and (d)(3)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)). Subsections (j) and (k) let an agency exempt some systems of records from these provisions by rule. As of September 2026.

- For each system of records, the [Senior privacy official] shall acknowledge each request to amend a record in writing within 10 days, excluding Saturdays, Sundays and legal public holidays, and then promptly correct the record or explain the refusal and how to request a review. (SI-18(4))
- The [Senior privacy official] shall complete the review of a refused amendment within 30 days, excluding Saturdays, Sundays and legal public holidays, unless the agency head extends the period for good cause. (SI-18(4))

#### De-identification (SI-19)

- The [System owner] shall remove the following elements of personally identifiable information from datasets that are to be de-identified: [Fill in: elements of personally identifiable information to be removed from datasets. Typical: direct identifiers such as names, addresses, identification numbers, contact details and full dates of birth, and any indirect identifiers the privacy review finds could re-identify individuals]. (SI-19a)
- The [Senior privacy official] shall evaluate the effectiveness of de-identification [Fill in: the frequency at which to evaluate the effectiveness of de-identification. Typical: annually, and before each new release of a de-identified dataset]. (SI-19b)

## Review and update

- The [Fill in: an official to manage the information security and privacy policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current information security and privacy policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current information security and privacy policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (XX-1c.1)
- The [Fill in: an official to manage the information security and privacy policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current information security and privacy procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (XX-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (XX-1a.1(b))