The SP 800-53 Rev. 5 PII Processing and Transparency family: authority and purposes for processing PII, consent, privacy notices, system of records notices, specific PII categories and computer matching, all in the privacy baseline.
The PII processing and transparency policy and procedures control: what the PT policy must address, who owns it, review and update cycles, and the documents assessors examine. Like all PT controls, it is in the privacy baseline only.
Determining and documenting the legal or other authority that permits each PII processing activity and restricting processing to what is authorized, with data tagging and automation as enhancements.
Identifying and documenting the purposes for processing PII, describing them in public privacy notices, limiting processing to compatible purposes and managing changes in processing.
Tools or mechanisms that let individuals consent to processing of their PII before collection and make informed decisions, with tailored consent, just-in-time consent and revocation as enhancements.
Privacy notices to individuals about PII processing: availability at first interaction, plain language, the processing authority and purposes, with Privacy Act statements as an enhancement in the privacy baseline.
System of records notices for Privacy Act systems of records: drafting per OMB guidance, advance review by OMB and Congress, publication in the Federal Register and keeping notices accurate.
Applying processing conditions to specific categories of PII, with Social Security numbers and First Amendment information as enhancements that are both in the privacy baseline.
Requirements for computer matching programs under the Privacy Act: Data Integrity Board approval, a matching agreement, a Federal Register notice, independent verification and a chance for individuals to contest before adverse action.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.