What PM-24 Data Integrity Board requires and why it is hard to evidence
PM-24 requires the agency to run a Data Integrity Board that performs two duties: it reviews proposals to conduct or participate in a computer matching program, and it conducts an annual review of all matching programs the agency has taken part in. The board is a governance body, and an assessor will test whether it exists, meets, and acts on matching activity. The NIST discussion says the board is made up of senior officials designated by the agency head and includes, at a minimum, the agency's Inspector General (if one exists) and the senior agency official for privacy. Under SP 800-53B, PM-24 is a program management control deployed organization-wide, so it is not allocated to the low, moderate or high baselines. It does appear in the privacy baseline, which applies regardless of system impact level, and it is related to PT-8, the computer matching requirements control.
The difficulty is that the evidence is records about decisions, not settings in a system. SP 800-53A assesses PM-24 through three determination statements using examine and interview methods. The assessor will examine the documents that establish the board, its charter of operations, its plans and reports, and the computer matching agreements and notices it has reviewed. They will also interview board members, which the assessment procedure names as the chief information officer, the senior information security officer, the senior agency official for privacy and the Inspector General. A configuration scan cannot show that a board met or that a proposal was rejected for stated reasons, so the program must keep dated minutes, decisions and annual review records as a matter of routine.
Before the assessment, confirm three things with your privacy office and general counsel: who the agency head has designated as board members, whether a matching program is in place or was ever proposed, and where the charter, agreements and annual review records are stored and who can produce them on request. If no matching program exists, the board still needs to be established and its records still need to show that the agency reviewed that position. Read the SP 800-53A Rev. 5 assessment procedures alongside your own charter so that each determination statement has a named document behind it.
Which agencies, programs and records fall under PM-24
PM-24 applies only where an agency runs or joins computer matching programs, so the first scoping question is whether any such program exists. The cards below cover the decisions that determine who sits on the board and which records it must review. Confirm each answer in writing before you assign owners or evidence.
Whether the agency runs or joins matching programs
PM-24 is triggered by computer matching, where automated comparisons of records against other records determine eligibility or benefits. Inventory every data exchange where your agency compares its records with another organization's records and decides something about individuals as a result. If that inventory is empty, document the search and its date, because the board's review duties depend on this answer. Confirm the definition with your privacy office and counsel.
Whether an Inspector General exists
The discussion for PM-24 names the agency's Inspector General, if any, as a minimum board member. Agencies without an Inspector General need to identify the senior official who takes that seat under their own governing rules. Record the organizational chart and appointment documents that show who holds the role, since an assessor will look for them when testing membership.
Senior officials designated by the agency head
Board members are senior officials designated by the agency head, and the minimum set includes the senior agency official for privacy. Other roles, such as the chief information officer or senior information security officer, appear in the assessment interview list and are common additions. Confirm the designation memo names each member and that the designations are current.
Matching agreements and notices in scope
The assessment procedure expects examination of computer matching agreements and the notices that accompany them. Build a register of every agreement, its parties, its term and its publication status. Mark which agreements are active, which have lapsed and which are pending board review, because the annual review covers all programs the agency has participated in.
Board charter and review records
The board's charter of operations, its plans and its reports define how proposals are reviewed and how the annual review is recorded. Check that the charter states the review cycle, the decision criteria and the escalation path. Missing or outdated charters are a common gap, so verify that the most recent annual review record exists and matches the agreement register.
Related PM-24 controls in the catalog
The catalog links PM-24 to AC-4, PM-19, PM-23, PT-2 and PT-8, so access enforcement, privacy leadership, data governance, authority to process and computer matching sit alongside the board. Map which of those controls your program already owns and where the board's decisions feed them. Gaps usually appear where a matching program depends on a data governance body that does not yet have a documented role.
How an assessor tests the Data Integrity Board
This table breaks the three SP 800-53A determination statements for PM-24 into the method an assessor uses, the documents or people they will request, and the findings that commonly come up. Read it as a preparation checklist: assemble the board records and interview-ready officials before the assessment starts.
| Determination focus | Method | Documents or people to request | Common findings |
|---|---|---|---|
| Board reviews proposed computer matching programs | Examine, interview | Board charter, establishing documents, minutes or records of proposal reviews, draft computer matching agreements | No written record that proposals were reviewed before matching began, or reviews undocumented |
| Board conducts the annual review of matching programs | Examine, interview | Annual review plans and reports, computer matching agreements and notices, list of matching programs the agency participated in | Annual review not performed or not evidenced, and agreements or notices not linked to a review cycle |
| Board membership and composition | Interview | Designation records from the agency head, role descriptions, attendance or membership lists | Membership not designated in writing, or Inspector General and senior agency official for privacy absent from the board |
| Board members can explain their role | Interview | Chief information officer, senior information security officer, senior agency official for privacy and Inspector General (where applicable) | Officials cannot describe the board's review duties or where its records are kept |
How to stand up a Data Integrity Board that passes review
This sequence moves an agency from confirming that it runs computer matching programs to a board that reviews proposals, reviews every matching program each year, and keeps its records tied to the matching agreements that PT-8 requires. Each step closes with an artifact an assessor can examine or an interviewee can confirm.
Confirm whether the agency runs matching programs
Start with an inventory of every arrangement in which the agency compares its records with another agency's or a non-federal organization's records to determine eligibility for, or recover payments under, federal benefit programs. The privacy office and program owners should complete this inventory together, because the answer decides whether the board must operate at all. Record the result in a signed memo that lists each program reviewed and the reason it does or does not qualify as a matching program. The assessor will ask for this memo first, because a documented "no matching programs" determination is the basis for scoping PM-24 out of active review.
Designate board members through the agency head
The agency head appoints the board by designating senior officials in writing. The NIST discussion for PM-24 sets a minimum membership that includes the agency's Inspector General, if one exists, and the senior agency official for privacy, so those roles must appear in the designation. Confirm that each designee holds a role with the authority to vote on or sign off on matching decisions. The signed designation letter, with names, titles and effective dates, is the artifact the assessor will check against the board's stated membership. The SP 800-53A procedure also expects interviews with board members, so confirm that each designee can describe the board's role.
Write the board charter
Draft a charter that sets out the board's purpose, membership, quorum, meeting cadence, decision records, and how it communicates with the agency head and the senior agency official for privacy. The charter should state that the board reviews proposals to conduct or participate in matching programs and conducts an annual review of all matching programs the agency has joined. Have counsel and the privacy office review the draft, then obtain approval from the agency head. Because SP 800-53A lists the charter of operations among the documents an assessor will examine, store the approved, dated version under document control and record any amendments.
Set the proposal review procedure
Document the steps a proposed matching program follows from initial request to board decision. The procedure should specify the intake form, the information the proposal must contain, the reviewers who assess privacy and security impact, the criteria for approval or rejection, and the point at which the agency head or designee signs the decision. Include a rule that no matching activity starts until the board has reviewed the proposal. Test the procedure on one hypothetical proposal, labeled as illustrative, to confirm that each role knows its task. The assessor will sample proposals and check that the record of each decision follows this procedure.
Schedule the annual review of all matching programs
Put the annual review on the board's calendar and assign a responsible owner for preparing the review package. The package should list every matching program the agency participated in during the period, show its current status, and identify any changes to the program's purpose, data elements, or participating parties. The board then records whether each program should continue, be modified, or be terminated. Confirm the review date with the board members in advance, since the annual review is a recurring obligation that the assessor will check for each cycle. Keep the signed minutes and the list of programs reviewed as the evidence for this step.
Link board decisions to computer matching agreements
Connect every approved matching program to a written computer matching agreement and to the notices and records the agency maintains under PT-8. Each agreement should reference the board decision that authorized it, and each decision should identify the agreement it governs. Check that the agreements contain the terms the board approved, such as the data elements, the purpose, and the retention rules. This link is where PM-24 meets PT-8, so the assessor will often trace a single matching program from the board's approval record through the agreement to the notice. Keep a cross-reference register that the privacy office updates whenever an agreement is signed, renewed, or ended.
Retain records and prepare for assessment
Gather the charter, designation letters, proposal files, decision records, annual review packages, minutes, agreements, and the cross-reference register into one controlled repository with retention periods that the agency's records schedule defines. Run a dry-run walk-through in which a privacy official traces one matching program from proposal to annual review, and fix any gaps the walk-through reveals. The output is an evidence index that maps each SP 800-53A examine and interview item to the document or person that satisfies it. Confirm with the agency's independent assessor or Inspector General which evidence format and sampling approach they expect, since assessment practices vary by organization.
Evidence that satisfies PM-24 and how to keep it current
PM-24 is tested mostly through documents and interviews, so the evidence is a set of records that show the Data Integrity Board exists, meets, reviews proposals and completes its annual review. The cards below cover each artifact and the dated log that keeps them current between assessments.
Board establishing documents
The establishing documents show that the agency created the Data Integrity Board and set its membership and authority. Keep the signed establishing instrument, the agency head's designation letter and any revision history in one controlled location. Check that the membership still includes the Inspector General, where one exists, and the senior agency official for privacy, since the NIST discussion names both as minimum members. Record the date of each change so an assessor can trace who sat on the board at any given time.
Charter of operations
The charter sets out how the board makes decisions, how often it meets, how quorum is reached and how proposals move through review. Assessors look for a charter that matches what the board actually does, so compare it against the minutes at each review cycle. Store every version with its approval date. If practice has drifted from the charter, either update the charter or correct the practice and record the reason.
Member designation records
Designation records show who was appointed to the board, by whom and for what term. Keep appointment letters and role descriptions for each senior official, including the chief information officer, senior information security officer and senior agency official for privacy, as the assessment procedure lists them as interview subjects. When a role changes hands, update the roster the same week and file the prior designation as a closed record rather than deleting it.
Proposal review records
Each proposal to conduct or join a matching program needs a dated review file showing the request, the analysis, the board's decision and any conditions attached. Keep these files complete even when a proposal is declined, because the absence of a decision record is a common assessment gap. Note who reviewed the proposal and confirm that the review happened before any matching activity started. Illustrative: a file that lists the proposal date, the decision date and the approving members is easier to trace than a loose email thread.
Annual review reports and matching agreements
PM-24 requires an annual review of every matching program the agency participated in, so each year needs a written report covering each program, its status and any issues found. Pair the report with the current computer matching agreements and the matching notices, and confirm that each agreement is still in force or has been closed. Assessors check that the report references the agreements it reviewed, so cross-reference them by identifier.
Dated review log and meeting minutes
A single review log tied to the annual cycle lists each evidence item, its owner, the date it was last checked and the next review date. Minutes from each board meeting record attendance, decisions and action items, and they should be stored with the log. Confirm the log before each assessment and after any change in board membership. Ask your assessor which evidence window they will test, because minutes and reviews outside that window may not count.
How PM-24 connects to PT-8 and the privacy baseline
PM-24 governs the board, and PT-8 governs the matching programs the board reviews. PM-24 asks the organization to stand up a Data Integrity Board that reviews proposals to conduct or join computer matching programs and reviews every matching program it takes part in each year. PT-8 is the control that sets the computer matching requirements themselves, so the two controls work as a pair: PT-8 defines what a compliant matching program must contain, and PM-24 defines who must approve it and who checks it afterward. Assessors look at both together. An organization that has a board on paper but no matching agreements to review, or matching activity that never reaches the board, has a gap in one of the two controls. Confirm the current text of both controls in the NIST catalog before you map them to internal policy, since the wording in the catalog is the reference an assessor will use.
PM-24 sits in the SP 800-53B privacy baseline regardless of impact level. SP 800-53B does not allocate PM-24 to the low, moderate or high baselines, because Program Management controls are deployed across the organization rather than per system. It does include PM-24 in the privacy baseline, which applies to systems irrespective of impact level. In practice, a system that processes PII and takes part in a matching program needs the board's oversight evidence even if its security categorization is low. Before you scope a program, check the privacy baseline profile for your release, and check which of your systems actually feed or receive matched data. Also cross-check the related controls AC-4, PM-19, PM-23, PT-2 and PT-8, because the board's membership draws on the senior agency official for privacy role in PM-19, and the data decisions it makes depend on the governance body described in PM-23.
What meeting PM-24 costs in staff time and external review
This table breaks down the cost components of running a Data Integrity Board under PM-24, who is paid for each, whether it is one-time or recurring, and what drives it up or down. NIST does not estimate compliance costs and no figure is supplied here, so use the table to structure a written scope and quote request rather than to budget. For most agencies the dominant cost is official time, because the board is made up of officials who already hold other roles.
| Cost component | One-time or recurring | What drives it | How to reduce it |
|---|---|---|---|
| Staff time for board members | Recurring, tied to proposal reviews and the annual review | Number of computer matching proposals, the number of matching programs in force, and how many board members sit on each review | Set a standing meeting calendar, agree a written review template, and delegate preparation to staff who report to the board |
| Legal and privacy review | Recurring, per proposal and per annual review | Complexity of each matching agreement, the data elements exchanged, and whether the senior agency official for privacy must sign off on each step | Reuse a standard matching agreement template and review only changed terms in later cycles |
| Documentation upkeep | Recurring, with a one-time setup of the board charter and procedures | Volume of matching agreements, notices and annual review records that must be kept and retrievable for assessors | Maintain one register of matching programs with links to each agreement, notice and annual review record |
| External review or assessor sampling | Recurring when an independent assessor tests the board, often during an assessment cycle | Assessor sample size, how many matching programs fall in the assessment period, and how complete the records are on first request | Prepare a single evidence pack per matching program before the assessment starts so sampling does not trigger new searches |
| Initial board setup | One-time | Whether the board charter, membership and review procedures already exist and whether the Inspector General is in place | Confirm membership and charter with the agency head early so the first review cycle starts from approved documents |
| Ask for in a quote | Not applicable | Written scope covering board members involved, number of proposals and matching programs, documents to produce and assessment support | Request each cost component as a separate line with assumptions stated, and confirm whether any assessor fees are excluded |
Who owns the board, who can help, and what the assessor checks
PM-24 is an agency obligation. The agency head designates the senior officials who sit on the Data Integrity Board, and the NIST discussion sets a minimum membership that includes the agency's Inspector General, if one exists, and the senior agency official for privacy. The board reviews proposals to conduct or participate in computer matching programs and conducts an annual review of every matching program the agency has taken part in. Those decisions, and the records of them, belong to the agency.
- Designation: Confirm the agency head's written designation of board members and keep it current when officials change.
- Charter approval: The board's charter of operations is adopted and maintained by the agency, not drafted and approved by a contractor.
- Proposal review: Each proposed matching program is reviewed and decided by the board, with the decision recorded.
- Annual review: Schedule and complete the annual review of all matching programs, and record findings and follow-up actions.
- Matching agreements: Retain the computer matching agreements and notices that the board relies on.
Check that your board membership, charter and review records match what the agency actually did in the period under assessment.
An implementation partner can help an agency prepare for an assessment. Its work is administrative and organizational: making the board's documents complete, consistent and easy to examine. The partner does not sit on the board, does not decide whether a matching program is approved, and does not sign off on the agency's annual review. Those roles stay with the agency's designated officials.
- Charter drafting: Prepare charter templates for the board's review and adoption, based on the agency's own legal and policy requirements.
- Evidence organization: Collect and index board documents, agreements, notices and plans so that an assessor can find them without delay.
- Review logs: Set up a log that records proposals, dates of review, decisions and annual reviews, which the agency's officials complete and approve.
- Readiness checks: Test whether the documents exist, match each other and reflect what the board actually did.
- Gap reports: Report missing or inconsistent records to the agency so it can decide how to close them.
Before engaging a partner, ask in writing which tasks it will perform, which decisions stay with the agency, and who will hold the records afterward.
The assessor tests PM-24 using the assessment procedure in SP 800-53A. It examines privacy program documents relating to the board, including the documents that establish the board, its charter, plans and reports, and computer matching agreements and notices. It also interviews board members, which the procedure lists as including the chief information officer, the senior information security officer, the senior agency official for privacy and the agency Inspector General. The assessor then issues findings. Under FISMA, Inspectors General independently assess agency system security and report to OMB, so the IG's independent view is a separate input from the agency's own program.
- Examine: Review the charter, designation records, proposal reviews, annual reviews and matching agreements against the three determination statements.
- Interview: Ask board members how decisions were made, who was present and how records were kept.
- Compare: Check whether the documents and the interviews tell the same story.
- Findings: Record the results as findings. The assessor, not the agency or its partner, determines whether the control is met.
- Independence: Confirm that the assessor is independent of the team that prepared the evidence.
Ask the assessor which evidence it will request and how it will sample matching programs before the review begins.
Where agencies fall short on the Data Integrity Board
PM-24 is short, but the gaps that show up in assessments cluster around a few decisions: who sits on the board, what it has written down, and whether it sees every matching program. Each card below is a gap an assessor can test with a document or an interview, along with the check that closes it.
No written board charter
Without a charter, the board has no agreed purpose, membership rules, quorum, or procedure for reviewing proposals. An assessor examining PM-24 looks for the documents that establish the board and its charter of operations. Check that the charter exists, names the review duties in PM-24, and has been approved by the agency head or the official who designated the members.
Members not formally designated
The NIST discussion expects members to be senior officials designated by the agency head, with the Inspector General, if any, and the senior agency official for privacy at a minimum. Informal attendance by whoever is available does not show that the required officials were appointed. Confirm the designation records name each required member and that they are current.
Matching programs missing from annual review
PM-24 requires an annual review of all matching programs the agency has participated in. Programs that were set up years ago, run by a single office, or ended without formal closure often fall off the list. Build a register of every matching program, record its review date, and confirm that the board reviewed each one in the last cycle.
Proposal decisions without records
Each proposal to conduct or join a matching program needs board review. When decisions are made by email or verbal agreement, the record of who reviewed what and why is missing. Keep minutes, the review package, the decision, and any conditions attached. An assessor interviewing board members will expect them to describe these decisions consistently.
Agreements not linked to board review
Computer matching agreements and their notices are the documents an assessor will compare against board decisions. If an agreement was signed without a board record, or a board approval refers to terms that were later changed, the link between the two breaks. Maintain a cross-reference from each agreement to the board decision that approved it, and recheck it when terms change.
PM-24 questions buyers ask before bringing in help
What does PM-24 Data Integrity Board require an agency to do?
PM-24 requires a Data Integrity Board that reviews proposals to conduct or participate in a matching program, and that conducts an annual review of every matching program the agency has taken part in. The control is about governance: the board is the body that decides whether a computer matching program goes ahead and whether existing ones still meet the rules. Assessors test it by looking for the board's founding documents, its charter, its plans and reports, and the computer matching agreements and notices it has reviewed, then by interviewing board members. A partner can help assemble that evidence and build a review calendar, but the board's decisions remain the agency's own.
Does PM-24 apply to non-federal organizations?
PM-24 is written around federal agencies and their computer matching programs, so it is most directly relevant to them. A non-federal organization would only face it if a federal agency, contract or regulator brings the requirement into its own obligations, or if it runs a matching program that the agreement terms make subject to a comparable review. Confirm the applicability in the written contract or regulatory text before scoping any work. Also check whether the control reaches your organization through the SP 800-53B privacy baseline, since PM-24 sits in that baseline regardless of system impact level.
Who has to sit on a Data Integrity Board?
The board is made up of senior officials designated by the agency head. At a minimum it includes the agency's Inspector General, if the agency has one, and the senior agency official for privacy. Assessors commonly expect to see other senior roles as well, such as the chief information officer and the senior information security officer, because the assessment procedure lists them as potential interviewees. The designation itself should be documented, so confirm the membership with the agency head's office and the board's charter rather than relying on an organization chart.
How long does it take to prepare for a PM-24 assessment?
No timeline has been supplied for this control, so the duration cannot be stated here. The length of preparation depends on whether the board already exists with a charter and a review history, how many matching programs need annual review, and how many documents must be gathered or written. Set the timeline with the agency, since its oversight office and the Inspector General set the expectations for evidence and review dates. Ask any partner for a fixed-scope written plan with milestones tied to those agency dates before work starts.
Can we prepare for PM-24 in-house?
Yes, in most cases the board's own members can prepare the governance evidence without outside help, because the work is mainly documentation and decision records. The effort tends to rise when the agency has no written charter, when past matching reviews were not recorded, or when the evidence is scattered across privacy, security and legal files. Staff who understand the agency's matching agreements and privacy program documents can estimate the internal effort. An outside partner is most useful for gap analysis, document structure and evidence organization, and only when the agency needs that help.
What does an implementation partner do for PM-24, and what does it not do?
A partner such as DeployOpen can help prepare the systems, controls and evidence that an assessment will examine. In practice that can mean structuring board records, mapping them to the assessment objects in SP 800-53A, and setting up review tracking for annual matching program reviews. A partner does not decide who sits on the board, approve matching programs, or make the board's determinations, because those are the agency's decisions. Partners also do not issue audit reports, attestations or certifications. Ask for the written scope to name the deliverables and exclusions explicitly before you sign.
Who issues the PM-24 assessment result?
An independent assessor issues the result, not the organization and not the partner that prepared the evidence. For federal systems, the assessment is performed by the agency's own assessors or by an independent party, and reporting runs through the agency's authorization and oversight processes, with Inspectors General assessing agency security independently under FISMA. Confirm with the agency which assessor will review the board's evidence, which report will record the outcome and who receives it. Do not treat any preparation work as a finding or certification in itself.
How DeployOpen prepares PM-24 evidence
DeployOpen prepares systems, records and evidence for an SP 800-53 assessment of PM-24, but it does not issue assessment results, attestations or certifications. Those come only from the independent assessor the agency engages. The agency owns the Data Integrity Board, its membership, its charter and every decision it makes on matching proposals and annual reviews. DeployOpen's role is to help the agency's privacy and information security staff assemble what an assessor will examine and interview about, such as the board charter, meeting records, matching agreements and notices, in a form that can be traced back to the controls.
Engagements are fixed-scope. Before work starts, the agency and DeployOpen agree in writing on which systems, records and evidence sets are in scope, what each deliverable is, and the timeline for delivery. A quote follows from that written scope, so the agency should expect the scope document to name the board documentation, the evidence owners and the review cycle it covers. Where a computer matching program runs on a self-hosted platform inside the agency's own environment, DeployOpen can also help confirm that the platform's logs and records support the review. Ask the assessor early which evidence formats and sample periods they expect, and confirm those requirements before the scope is signed.
