PM-21 Accounting of disclosures: requirements and evidence

PM-21 accounting of disclosures: what the requirement asks for

If a privacy assessment or a Privacy Act obligation now asks for a disclosure record, the short answer is that PM-21 requires an accurate accounting of every disclosure of personally identifiable information (PII). Each entry must record the date, the nature and purpose of the disclosure, and the recipient's name and contact details. The record must be kept for as long as the PII it relates to is kept or five years after the disclosure, whichever is longer, and it must be available to the individual on request. NIST notes that federal agencies are required to keep this accounting under the Privacy Act, and that any record system will do if it can produce a list of all disclosures with the required information.

The difficulty is completeness, not format. Disclosures leave an organization through many channels: application APIs, bulk exports to partners, email attachments, support tickets, law enforcement requests, data sharing with processors and reports to regulators. A record kept only by the team that handles formal requests will miss most of them. Before choosing a tool, compliance leads should map every path that moves PII out of each system, name the owner of each path, and confirm which of those paths already write audit events that can supply the date, recipient and purpose. Access control (AC-3) and audit logging (AU-2) are the related controls an assessor will look at to judge whether those events exist and can be trusted.

PM-21 is a Program Management control. NIST's SP 800-53B baselines do not allocate it to the low, moderate or high baseline, because Program Management controls are deployed across the organization and do not depend on a system's impact level. It does appear in the privacy baseline, which applies to systems regardless of impact level, so a system that processes PII is in scope for it even if its security categorization is low. Confirm with the privacy office which systems hold PII, since that list, not the security baseline, determines where the disclosure record must reach. The assessment procedure in SP 800-53A Rev. 5 examines disclosure policies, records and audit logs, interviews privacy program staff and tests the processes that produce the accounting.

Which disclosures, systems and teams PM-21 reaches

PM-21 is easiest to scope by starting with the personally identifiable information the organization holds, then following each disclosure out of the system that holds it. The cards below cover the decisions that determine which records, teams and third parties fall inside the accounting, and where the control sits relative to AC-3, AU-2 and PT-2.

PII holdings and record systems

Begin with an inventory of the PII the organization holds and the systems that hold it, because PM-21 applies to disclosures of PII wherever they originate. Confirm whether the PII inventory required under PM-5(1) is current, since it is the most direct starting list. Any record system may be used for the accounting if it can produce a list of all disclosures with the required information, so the question is not which tool holds the log but whether one authoritative source covers every system holding PII. Spreadsheets, ticketing queues and shared mailboxes often hold disclosure records outside the main application and should be checked during scoping.

What counts as a disclosure

Define disclosure in policy before counting anything, because the control requires the date, nature and purpose of each disclosure and the recipient's name and contact details. Decide whether internal transfers between components, bulk exports, API calls returning PII and responses to subpoenas each count. Document the rule so that two analysts classify the same event the same way. Ask the privacy office to confirm how it treats disclosures that are required by law, since the accounting obligation and exemptions depend on the legal basis for each release.

Routine uses and processor transfers

Routine uses, the recurring disclosures an agency has published in its system of records notices, are a common gap because they run automatically and rarely generate a manual record. Map each routine use to the system that performs it, then confirm that every transmission is logged. Disclosures to contractors and processors that handle PII on the organization's behalf also belong in scope when they move records out of the organization's control. Ask the contract owner for a list of every processor receiving PII and the mechanism that records each transfer.

Teams that disclose outside the system

Many disclosures happen outside any application: a help desk reading a customer record to a caller, an analyst sending a file to another agency, or a records officer answering a request by email. These teams need written procedures that tell them to create an accounting entry at the time of disclosure. Interview each team that handles PII and confirm what it releases, to whom and how it records the release. Gaps in these manual channels are the most frequent reason an accounting looks complete in the system but misses real disclosures.

Third parties and external recipients

Each recipient needs a name and contact details in the accounting, so the organization must be able to identify who received the PII, not only the category of recipient. Notification and alert services that track disclosures, which the assessment procedure names as a mechanism to test, should be listed alongside the recipients they monitor. Confirm that contracts with recipients allow the organization to obtain the information needed for an accounting when an individual asks. Missing contact details for external recipients are a frequent finding that the organization can close only through contract terms.

How PM-21 relates to AC-3, AU-2 and PT-2

PM-21 is an organization-level program control, but its evidence comes from system controls. AC-3 enforces the access decisions that determine whether a disclosure is authorized, AU-2 defines which events are logged, and PT-2 governs the authority and purposes for processing PII that each disclosure must cite. PM-21 is in the privacy baseline, which applies to systems regardless of impact level, so a low-impact system holding PII still falls under it. Map each system to these related controls so the accounting, access records and logs tell a consistent story.

How an assessor tests PM-21 under SP 800-53A

This table maps how an assessor works through the eight SP 800-53A determination statements for PM-21, showing what is examined, who is interviewed and what is tested. Read each row as an evidence request: the artifact or conversation the assessor will ask for, and the gap that commonly produces a finding.

Assessment element	What the assessor does	Evidence to have ready	Common finding
Examine: disclosure policies and procedures	Reads the written rules for when a disclosure is recorded, what fields are captured and who approves releases of PII	Current disclosure policy, procedure owner, approval record and review date	Procedure covers releases to third parties but not disclosures to internal or contractor staff
Examine: records of disclosures	Samples disclosure entries and checks each for date, nature, purpose, recipient name and recipient contact details	Accounting log extract with the required fields populated for the sampled period	Entries record the recipient organization but omit a named contact or contact details
Examine: audit logs	Checks whether system audit trails independently show the disclosures recorded in the accounting	Audit log extracts tied to the systems that release PII, with retention settings	Disclosures made through a batch export or API appear in logs but not in the accounting record
Examine: Privacy Act policies and procedures	Confirms the organization's Privacy Act handling rules cover accounting duties for federal agency systems	Privacy Act implementing rules and the mapping from them to disclosure procedures	Policy restates the statute without assigning who maintains the accounting
Examine: system of records notices	Compares disclosures recorded against the routine uses published for each system of records	Published notices for each system, plus a list of routine uses referenced by the disclosure log	Disclosures logged under purposes that no published routine use describes
Interview: personnel with privacy program responsibilities	Asks the privacy officer and records staff how disclosures are identified, logged and retrieved for an individual	Named roles, responsibilities and a walkthrough of a sample retrieval request	Staff who release data do not know they must log the release, so disclosures go unrecorded
Test: disclosure processes and supporting mechanisms	Runs a sample disclosure through the process and checks that the accounting entry is created and retrievable	Test record showing the disclosure, the accounting entry and the retrieval output	Manual logging depends on a single person, and the test finds gaps during peak release periods
Test: notification and alert services	Verifies any commercial or internal notification or alert service that informs the individual or staff of disclosures	Service configuration, alert rules, delivery logs and the owner of each alert	Alerts fire for some disclosure types only, and failed deliveries are not tracked

Implementing an accounting of disclosures step by step

This sequence turns PM-21 from a policy statement into a working record: every PII disclosure is captured with the required fields, kept for the required period, and retrievable for the individual who asks. Each step closes with a check that an assessor can review.

Inventory every PII disclosure path
Start by listing each route through which PII leaves the organization: application APIs, batch file transfers, reports sent to partners, regulator submissions, data shared with processors, and manual releases such as emailed extracts. The privacy office and system owners should confirm the list against the PM-5(1) PII inventory, since a disclosure path missing from the inventory will be missing from the accounting. The step is done when each path has a named owner and a documented trigger, and the team can say which systems and records each path touches.
Define the required fields for each entry
Write a record specification that captures the date of each disclosure, its nature (what PII was disclosed), its purpose, and the recipient's name and contact details. Ask the privacy officer to confirm the wording of the purpose field against the authorities the organization relies on, because a vague purpose such as "business use" will not help an individual or an assessor. The output is a signed field definition that every disclosure path must populate, with examples so system owners know what a complete entry looks like.
Choose the record mechanism
Select the system that will hold the accounting. The NIST discussion for PM-21 allows any record system that can produce a list of all disclosures with the required information, so the choice can be a dedicated register, a database table with restricted write access, or a logging pipeline that the organization already operates. Confirm with the platform team that the mechanism can export a complete list per individual and per period. The step is complete when a test disclosure can be written, retrieved and matched to all required fields.
Connect disclosure paths to the record
Integrate each path from the first step so that a disclosure writes an entry automatically or through a documented manual procedure. Automated paths should write from the application or integration layer, where the recipient and purpose are already known. Manual releases need a form or ticket that cannot be closed until the fields are complete. Audit logs from AU-2 and AU-3 can supply supporting detail, but they are not a substitute for the accounting itself. The check is a reconciliation: a sample of outbound transfers over a set period should each have a matching accounting entry.
Set retention to the longer period
Configure retention so each accounting entry is kept for as long as the related PII is kept, or five years after the disclosure, whichever is longer. Implement this as a rule in the record store, not as a reminder, so that deletion of the PII does not delete the accounting early. Records should be protected from alteration, and deletion should itself be logged. The output is a retention schedule that the privacy office has approved and a configuration export that shows the rule applied to the store.
Build the individual request process
Define how an individual asks for their accounting, how the organization verifies identity before releasing details, which official owns the response, and how the response is delivered. Assemble the request template and the export query that produces a list for one person, including disclosures made by processors where the organization is accountable. Ask counsel to confirm how the process fits any statutory deadlines that apply to the organization. The check is a tabletop run in which a staff member answers a sample request end to end and the privacy office signs off the output.
Test the full chain and document the results
Run an end-to-end test that starts with a simulated disclosure, confirms the entry was written with every field, checks retention and access controls, and ends with a sample individual request that returns the correct list. Record the test scenarios, results and corrections in a dated test report. Interviews with privacy program staff, as assessors use under SP 800-53A, can then confirm that people understand their roles. Repeat the test after any change to a disclosure path or the record mechanism.

Evidence that passes a PM-21 review

An assessor testing PM-21 wants to see that the organization can produce a complete, accurate list of PII disclosures on request, and that the process behind that list is written down and followed. The cards below cover the documents, records and checks that connect those two points, and the routine work that keeps them current between assessments.

Disclosure policies and procedures

The written rules that decide when a disclosure of PII must be logged, who approves it, and which fields every entry must carry: the date, the nature and purpose of the disclosure, and the recipient's name and contact details. Assessors examine this document first. Check that it covers disclosures made by people as well as those made automatically by systems, and that it names the owner who keeps it current. A procedure that exists only in an engineering wiki with no approver is weak evidence.

The disclosure record itself

The accounting record is the core artifact. It must list every disclosure of PII in a form that can be filtered by individual, recipient and date. The NIST discussion accepts any record system that can produce such a list, so a database table, a case management queue or a structured log all qualify if they hold the required fields. Test the record by picking a disclosure from a source system and confirming it appears with all required information.

Audit logs supporting the record

Application and system audit logs show that disclosures happened and that the accounting entries were created when they should have been. Assessors compare these logs with the disclosure record to find gaps, such as transfers that were logged at the system level but never recorded as disclosures. Confirm that logs are retained long enough to cover the retention period in the record, are protected from modification, and can be searched by the same identifiers used in the accounting record.

Privacy Act procedures and system of records notice

For federal agencies, the Privacy Act procedures explain how disclosures are authorized and accounted for, and the system of records notice (SORN) describes the records and routine uses that apply to them. Assessors check that the disclosures in the record match the routine uses stated in the SORN. Any disclosure that falls outside a published routine use should trigger an escalation step in the procedure. Ask privacy counsel to confirm that the SORN is current before the assessment begins.

Retention schedule and disposal evidence

PM-21 requires each accounting entry to be kept for as long as the related PII is kept, or for five years after the disclosure, whichever is longer. The retention schedule should state that rule in plain terms and map it to the systems that hold the records. Keep evidence that expired entries are removed on schedule, and that entries for PII still in use are not deleted early. A schedule that does not reflect the longer of the two periods will fail review.

Sample individual requests and responses

Assessors often ask for a set of requests from individuals to see the accounting in use. Each file should show the request, the date it was received, the disclosures found for that person, the response sent and the date it was sent. Keep a log of requests so that none is missed. Between audits, run a periodic sample of disclosures against the source systems that produced them and record the result, so that gaps are found by the organization before an assessor finds them.

What meeting PM-21 costs in money and effort

This table breaks down the cost components of keeping a PM-21 accounting of disclosures, who is paid for each, whether it is one-time or recurring, and what drives it up or down. Use it to scope internal effort and to check that a quote covers each line. No figures are given because none are supplied for this control, so every number should come from your own quote or environment.

Cost component	Who is paid or who spends time	One-time or recurring	What drives it
Build the disclosure record and request workflow	Engineering or platform staff, or an implementation partner under a written scope	One-time, with later changes	Number of disclosure channels, systems holding PII, and whether records are captured automatically or by hand
Define disclosure rules and review logic	Legal and privacy staff, with input from the senior agency official for privacy	One-time, then periodic review	Number of disclosure types, routine uses, and agreements with recipients
Hosting and storage for retained records	Infrastructure team; cloud or data center charges if self-hosted	Recurring	Record volume, retention period (longer of PII retention or five years), and backup copies
Individual request handling	Privacy office staff who retrieve and deliver accountings	Recurring	Volume of individual requests and how quickly records can be queried by person
Periodic sampling and quality checks	Privacy or internal audit staff, sometimes with engineers	Recurring	Sampling frequency, number of disclosure channels, and recipient count
External review or independent assessment	Independent assessor or auditor; the organization owns the decision	Periodic, per assessment cycle	Assessment scope, number of systems in the privacy baseline, and assessor sampling approach
Open-source software licenses	No license fee for the core platform; staff time still applies	Not applicable for core software	Choice of components and whether support or a retainer is bought separately

Who owns PM-21 and what a partner can prepare

The organization owns the decisions that PM-21 depends on. Your privacy office and the system owners decide which disclosures are permitted, record the date, nature and purpose of each one, and capture the recipient's name and contact details at the time of disclosure. No partner can make those judgments for you, and an assessor will ask who made them and how they were documented.

Disclosure decisions: Confirm who may authorize a disclosure of PII and what justification is required before release.
Record content: Define the fields each disclosure record must hold, including date, nature, purpose and recipient details.
Retention rule: Set the retention period in policy, based on the rule that records are kept for as long as the PII is kept or five years after disclosure, whichever is longer.
Individual requests: Assign ownership for responding to a request from an individual for their accounting.
Policy and procedures: Approve the disclosure procedures the assessor will examine under PM-21.

Check that each named owner can show signed policy, a current authorization list and a sample of completed records.

Where PM-21 programs usually fall short

Most PM-21 findings come from the gap between a disclosure that happened and a disclosure that is recorded in a form someone can produce. The cards below cover the places where that gap usually opens, paired with the fix an assessor would expect to see.

Disclosures made outside the record

Staff often share PII by phone, email or a quick file transfer and never log it. The PM-21 accounting is only as complete as the channels feeding it. Map every route PII leaves the system, including ad hoc requests from partners and internal teams, and decide which channels must write to the disclosure record. Check a sample of outbound emails and support tickets against the log during assessment preparation, since an assessor may test for exactly this gap.

Missing recipient contact details

A disclosure entry that names an organization but not a contact person or address cannot answer an individual who asks who received their data. Make recipient name and contact details mandatory fields at the point of disclosure, and validate them against the recipient's current records. Reviewing entries for blank or placeholder contact fields is a quick check that shows whether the record meets the requirement in practice.

Generic purpose fields

Entries such as "business use" or "other" record that a disclosure happened but not why, which defeats the purpose of the accounting. Replace free text with a short list of defined purposes tied to the legal basis or agreement that authorized the disclosure, and require a specific description when the list does not fit. Sample entries and ask whether the stated purpose would make sense to the individual reading it.

Retention tied to the PII

Teams often purge disclosure records when the underlying PII is deleted, which breaks the requirement that the accounting be kept for as long as the PII is kept or five years after the disclosure, whichever is longer. Set the retention rule for the disclosure log separately from the data it describes, and confirm the deletion workflow does not remove accounting entries early. Check that backups and archives follow the same rule.

No tested process for individual requests

Many programs can describe how a person would ask for their disclosure history but have never run the request end to end. Define who receives the request, how the identity of the requester is checked, how the log is filtered by individual, and how the response is delivered and recorded. Run a test request before assessment and keep the output, because the assessment procedure expects to test the mechanisms that support the accounting, including any commercial notification services used.

PM-21 questions buyers ask before hiring help

How much effort does PM-21 take to put in place?

The effort depends mostly on how many systems hold PII, how many disclosure paths exist and how well those disclosures are already recorded. PM-21 asks for an accurate accounting that records the date, nature and purpose of each disclosure, the recipient's name and contact details, and keeps those records for as long as the PII is kept or five years after the disclosure, whichever is longer. Organizations that already log disclosures in a consistent place usually need less work than those where disclosures happen through email, paper forms and ad hoc data pulls. Cost drivers include the number of disclosure channels to map, the volume of requests, the quality of existing logs and the number of teams that must sign off on the procedure. Ask any partner for a written breakdown of these drivers before agreeing to a fixed scope.

Can a spreadsheet satisfy PM-21?

Yes, a spreadsheet can satisfy PM-21 if it can produce a complete list of disclosures with every required field. NIST's discussion for the control says any record system may be used if it can produce that list. The practical test is retrieval: can the team pull every disclosure of one individual's PII, with the date, nature, purpose, recipient name and contact details, and provide it on request? A spreadsheet fails this test when entries are inconsistent, when access is uncontrolled, when records are edited without an audit trail, or when retention is not enforced. Many organizations move to a ticketing system or a self-hosted records database once volumes grow. Confirm with your privacy office and assessor how the records will be protected and retained before choosing the tool.

How long does a PM-21 implementation take?

The timeline depends on the scope agreed in writing, the number of systems and disclosure paths, and how quickly the client's privacy and legal teams can approve procedures and retention rules. No general duration applies, and no federal timeline for implementing PM-21 has been set by NIST, which leaves implementation schedules to OMB Circular A-130. A typical sequence covers identifying disclosure points, defining the record format, configuring the record system, writing the disclosure procedure, testing retrieval and preparing evidence for assessment. Delays most often come from unclear ownership, incomplete inventories of PII holders and approval cycles for procedures. Ask for a milestone plan with named client dependencies, not a single end date.

What does the client need to provide for PM-21 work?

The client needs to provide the people and information that define the disclosures. This includes a named privacy official who owns the procedure, access to the systems and business processes that disclose PII, copies of existing disclosure policies, records of past disclosures where they exist, and the Privacy Act policies and any system of records notices that apply. Legal or privacy counsel must confirm which disclosures are permitted and what purpose each one serves. Engineers need read access to logs and databases that show data movements, and operations staff must agree on how requests from individuals will be routed and answered. Missing inputs in these areas are the most common reason a fixed-scope engagement runs longer than planned.

Can a partner issue a PM-21 certificate or attestation?

No. An implementation partner prepares systems, procedures and evidence for PM-21, but only an independent assessor or auditor can issue an assessment result or report. DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure and prepares the evidence an assessor will examine, including disclosure records, procedures and audit logs. The client owns the control and decides how it is run. Federal agencies assess their own systems through their own processes, and under FISMA, Inspectors General independently assess agency system security and report to OMB. Ask any firm to show who will perform the independent assessment and what that party will deliver.

How does PM-21 relate to the SP 800-53B privacy baseline?

PM-21 is part of the SP 800-53B privacy control baseline, which applies to systems regardless of impact level. SP 800-53B describes Program Management controls as deployed across the organization rather than per system, so PM-21 is not allocated to the low, moderate or high security baselines. For a system that processes PII, this means PM-21 applies even if the system's security impact level is low. The related controls listed for PM-21 are AC-3, AU-2 and PT-2, so access enforcement, audit events and authority for processing often need to be designed together. Confirm with your assessor which systems fall within the privacy baseline and how the organization-wide procedure covers them.

What evidence will an assessor ask for under PM-21?

An assessor following SP 800-53A examines disclosure policies and procedures, records of disclosures, audit logs, Privacy Act policies and procedures and system of records notices. The assessor also interviews personnel with privacy program responsibilities and tests the organizational processes and mechanisms that support the accounting, including any commercial services that send notifications or alerts. Prepare a sample of disclosure records showing every required field, evidence that retention rules are enforced, and a walkthrough of how an individual's request is answered. Ask your assessor to confirm the sample size and the form of evidence they will accept before collection begins.

Should we hire a partner or handle PM-21 internally?

The answer depends on whether the team has privacy engineering capacity, a clear owner for the procedure and time to build and test a record system. Internal teams are well placed to define disclosure rules because they know the data and the business purposes. A partner can add value by configuring self-hosted record systems, documenting procedures, preparing assessment evidence and running a retrieval test. Either way, the organization keeps ownership of the control and of the disclosure decisions. Compare written scopes from several providers, check that each one states what is delivered and what the client must supply, and confirm that independent assessment remains separate from implementation.

What changes for privacy teams once PM-21 is in place

PM-21 changes disclosures from something people remember to something the organization records. Before the control is in place, a request to share PII with an outside party may be approved in an email thread, handled by a program office and never written down in a place the privacy team can find. Once PM-21 is implemented, every disclosure of PII passes through a defined step that captures the date, the nature and purpose of the disclosure, and the recipient's name and contact details. The privacy team's first real change is that it stops reconstructing history from memory and starts reviewing a record that already exists. The NIST discussion accepts any record system that can produce a complete list of disclosures with that information, so the decision is less about buying a new tool and more about deciding where the log lives, who writes to it, and who can export it.

Privacy officers take on a review role that did not exist in that form before. Someone accountable for the privacy program should check that disclosures are being logged at the point they happen, that entries are complete, and that the disclosures recorded match what the audit logs and access records show. This is where the work of PM-21 meets the related controls the catalog links to it, namely AC-3, AU-2 and PT-2, so the review should compare disclosure entries against access enforcement and audit records rather than treating the log as a standalone spreadsheet. Teams should also agree in advance who can authorize a disclosure, because the log is only as reliable as the approval step that feeds it. Confirm with your assessor which records they will expect to examine and how they will test the mechanisms that produce them.

The biggest operational shift is the individual's path to the record. PM-21 requires that the accounting be made available to the individual on request, which means the privacy team needs a defined intake route, an owner for each request, a method to retrieve the relevant entries for a named person, and a documented way to handle requests that cover disclosures made under a retention period longer than the minimum. Retention is a decision to make early: the required period is the longer of the period the PII is kept or five years after the disclosure, so teams should check whether their log storage and deletion rules honor that rule for every system of records involved. Plan for requests to arrive through channels that were never designed for them, and test the path end to end before an individual or an oversight body asks.

How DeployOpen prepares PM-21 evidence

DeployOpen's role in PM-21 is to prepare the disclosure record and the workflows that feed it, not to decide whether the record is adequate. We plan, implement and document the self-hosted open-source systems that hold disclosure entries inside your own cloud accounts, data centers or air-gapped networks. In practice that means agreeing with your privacy office which disclosures must be logged, designing the record fields (date, nature, purpose, recipient name and contact details), configuring retention so entries are kept for as long as the PII is kept or five years after the disclosure, whichever is longer, and documenting how an individual's request for their accounting is fulfilled. Your organization owns the policy, the disclosure decisions and the answer given to the individual. Only an independent assessor can issue a finding on whether PM-21 is met.

Work is delivered under a written fixed scope. Before any engagement starts, the scope, deliverables and timelines are agreed in writing, and a quote follows from that scope rather than from a standard price list. Ask the implementation partner to list in the scope which record systems, log sources and disclosure channels are included, who inside your organization signs off each deliverable, and whether testing of the accounting mechanism, including any commercial notification or alert service, is part of the work or left to your team. Recurring items such as retention reviews, upgrades and periodic testing are usually priced separately and should appear as their own line in the quote.

Before you commission this work, confirm three things with your privacy office and assessor: the disclosure categories they expect to see recorded, the evidence format they will accept (for example, exported records with a documented query method), and the sampling approach they will use when they test the process. Those answers determine the record design and the evidence package DeployOpen prepares. Keep the policy, procedure and record samples in the same repository so an assessor can trace each claim to a stored entry.

PM-21 Accounting of disclosures