PT-8 Computer matching requirements: what it asks

PT-8 computer matching requirements: what a matching program must have in place

If your agency or program compares its records with another organization's records to decide eligibility or benefits, PT-8 requires that the matching program have Data Integrity Board approval, a computer matching agreement, a matching notice published in the Federal Register, independent verification of results where required, and notice to individuals with a chance to contest findings before any adverse action. The control exists because automated matching can act on a wrong record. A name or identifier that looks the same across two systems can pull in the wrong person, and a benefit can be cut or a debt raised before anyone checks. The requirement forces the privacy and legal review to happen before the match runs, not after the damage is done.

The hard part is that PT-8 is a process control, not a technical one. The matching agreement, the Data Integrity Board determination and the Federal Register notice are documents that must exist and match what the system actually does. Assessors under SP 800-53A examine those documents, interview the people who run the program and test whether the processes for the matching program work as written. Before scoping, confirm with your privacy office and counsel which of your data flows meet the statutory definition of a matching program, since that determines whether PT-8 applies at all. Then confirm who owns the Data Integrity Board submission, who signs the agreement with the other party, and how adverse-action notices are generated and held until the contest period closes.

PT-8 sits only in the privacy baseline in SP 800-53B, which applies to a system regardless of its impact level. A low-impact system that performs matching carries the same PT-8 obligations as a high-impact one, so a system's security categorization does not reduce the privacy work. The related control in the Release 5.2.0 catalog is PM-24, which covers the organization-wide privacy program, so plan PT-8 evidence alongside that program-level material. For the exact determination statements and assessment methods, review the NIST CPRT entry for PT-08.

Which matching programs and systems fall under PT-8

Before PT-8 work starts, the organization has to settle a few scoping questions: whether a data comparison is a matching program, which systems hold the records, who signs the agreements and how the privacy baseline applies. Each decision below changes the people, documents and evidence that an assessor will examine. Confirm every applicability question with counsel and the Senior Agency Official for Privacy.

Whether the comparison is a matching program

The first question is whether the activity is a computer matching program under the Privacy Act at all. Matching generally involves computerized comparison of records from two or more systems of records to establish or verify eligibility for, or recovery of payments under, federal benefit programs, or to take adverse action against individuals. Ad hoc queries, internal reconciliations and analytics that do not meet that definition may follow different requirements. Ask counsel to document the determination in writing, because every later PT-8 step depends on it.

Systems of records involved

Each side of a proposed match has to be traced to a Privacy Act system of records and its published system of records notice. Inventory the source and recipient systems, the data elements compared and the routine uses that permit the disclosure. A comparison that draws on a system whose notice does not cover the purpose is a scoping problem before it is a technical one. Assessors examine these notices as potential evidence under PT-8.

Parties that sign and approve

A matching program usually involves a source agency, a recipient agency and a Data Integrity Board, and the arrangement is recorded in a computer matching agreement. Identify who owns each side, who must approve the agreement and who holds signing authority. Contractors and implementation partners that run the comparison do not replace these approvals. Their role should be written into the agreement or contract so the responsible agency can show who did what.

Third parties handling the records

When a contractor, cloud provider or integration partner receives or processes records for a match, those parties become part of the scope. Document where the data is stored, which personnel can run the comparison and how results move back to the agency. Contract terms should reflect the matching agreement's limits on use and retention. Ask each third party to show how it keeps the comparison within the agreed purpose.

Privacy baseline applies regardless of impact level

SP 800-53B places PT-8 in the privacy control baseline, which applies to a system irrespective of its security impact level. A low-impact system that performs matching still needs PT-8 work, while a high-impact system without any matching activity may not. Teams that scope PT controls only from a security categorization will miss this. Record the privacy baseline selection separately from the security baseline so the PT-8 scope is visible to assessors.

Scope changes that reopen the decision

Scope should be revisited when the data elements, purpose, recipient or retention period of a comparison changes. A new matching use, an added data source or a different adverse action step can turn an existing activity into a matching program that needs approval. Assign an owner to monitor these changes and route them to the Data Integrity Board and privacy office. Keep dated scoping memos so the organization can show when each decision was made and by whom.

How an assessor tests PT-8 under SP 800-53A

This table maps the SP 800-53A Rev. 5 assessment methods for PT-8 to the objects an assessor examines, interviews and tests, and the findings that commonly appear for each. Use it to prepare evidence before an assessment, since each row shows what an assessor will ask to see and where programs usually fall short.

Assessment method	What the assessor examines or tests	Common findings
Examine	Privacy notices, Privacy Act systems of records, Federal Register notices, Data Integrity Board determinations and contracts for each matching program	Matching agreement is missing, expired or not updated after a change in the matched data; Federal Register notice not located for the program
Interview	Organizational personnel with PII processing and transparency responsibilities, such as privacy officers, program owners and staff who run the match	Staff cannot describe when the Data Integrity Board must approve a match or who owns the matching agreement
Test	Organizational processes for supporting and implementing the matching program, including how results are verified before any adverse action	No documented step for independent verification before adverse action; matches run without a current Data Integrity Board determination
Examine	Notice sent to individuals identifying the match and the adverse action it could trigger	Notice template is outdated or does not describe the matching program accurately
Test	Procedure that gives individuals an opportunity to contest findings before adverse action is taken	No documented contest procedure; contest requests are not logged or tracked to resolution
Interview	Staff who handle adverse action decisions based on match results	Decision makers rely on match output without checking the verification step, or cannot show when they acted on a contested finding
Examine	Records showing that the program, agreement and notices were reviewed on a recurring basis	Review dates are absent, so the assessor cannot confirm the program is current

The sequence to put a matching program through PT-8

This sequence takes a proposed data comparison from an initial scoping question to a matching program that has the governance, notices and contest workflow PT-8 expects before any adverse action is taken. Each step ends with a record an assessor can examine.

Confirm the comparison is a matching program
Start by testing the proposed data comparison against the Privacy Act definition of a computer matching program, with privacy counsel and the system owner both signing the analysis. Identify the source and recipient systems, the federal benefit or personnel purpose, and whether the comparison is automated and covers records on individuals. The output is a written determination stating whether the comparison is a matching program or falls outside it. If the answer is unclear, record the open questions and resolve them before any data moves, because every later step depends on this classification.
Establish the Data Integrity Board and its review record
Where the determination says the comparison is a matching program, bring it to the Data Integrity Board for the agency. The Board reviews the proposal and records its approval or disapproval in writing, with the reasons and any conditions. Confirm the Board's membership, meeting process and the date of its determination with your agency's privacy office, since these come from agency governance rather than from SP 800-53 itself. The output is a signed Board determination that PT-8 assessors will examine.
Draft and approve the computer matching agreement
Write the computer matching agreement between the source and recipient organizations. It should cover the purpose and legal authority for the match, the records and data elements exchanged, how the data is transmitted and secured, accuracy and verification procedures, retention and destruction, the notice and contest process, and the security safeguards each party applies. Both parties sign it, and the Data Integrity Board review should cover the final text. The output is an executed agreement held with the program's privacy documentation.
Prepare and publish the Federal Register matching notice
Draft the matching notice describing the matching program, its purpose, the agencies involved, the categories of records and individuals, and the routine uses that apply. Route the draft through the privacy office and the Board, then publish it in the Federal Register before the matching program begins. Confirm the required publication lead time and any congressional or OMB notification steps with your agency's privacy office, since those requirements sit outside the supplied facts. The output is the published notice and a copy of the publication record.
Define independent verification of match results
Document how the agency confirms match results before relying on them for adverse action. Define who performs the verification, which data elements are checked against independent sources, how discrepancies are classified, and what must be true before an adverse decision proceeds. Where the program requires independent verification, the verification must be separate from the matching output itself. The output is a written verification procedure and a sample verification record template that the program team can complete for each match cycle.
Build the adverse-action notice and contest workflow
Design the workflow that notifies individuals of a proposed adverse action based on match results and gives them a defined opportunity to contest the findings before the action is taken. The workflow should specify the notice content, the delivery method, the response period, how responses are logged, and who reviews them. Build it so that no adverse action can be recorded without a completed notice and contest record. The output is an approved notice template, a workflow description and a case log that shows each individual's notice and response.
Run a pre-launch assessment against PT-8
Before the first match runs, test the program against the seven determination statements in the SP 800-53A assessment procedure for PT-8. Examine the privacy notice, system of records notice, Federal Register publication, Board determination and contracts, interview the staff who run the program, and test the operating processes for the matching workflow and contest handling. Record each finding and close any gap before launch. The output is a pre-launch assessment record that maps evidence to each determination statement, which becomes the baseline for later reviews.

Evidence that satisfies PT-8 and how to keep it current

PT-8 is tested by examining documents, interviewing the people who run matching programs and testing the processes behind them. The cards below cover the artifacts an assessor will ask for, and each one needs a recurring owner and review date so the evidence stays accurate between assessments.

Data Integrity Board determinations and minutes

Records showing that the Data Integrity Board approved each matching program before it started, with the minutes, votes and any conditions attached. Assessors examine these against the determination statements for PT-8. Check that each determination names the specific program, the agencies involved and the period it covers, and that the record is dated before any data moved. Set a review date on each determination so an expired or renewed program is not left running on old approval.

Signed computer matching agreements

The written agreement between the source and recipient parties that sets out the purpose, legal authority, data elements, retention, security safeguards and verification steps. The signed version is the evidence, not a draft in a shared folder. Confirm that each agreement has an effective date, an expiration date and a named owner on each side. Schedule a review before expiration so that renewals run through the Data Integrity Board rather than lapsing silently.

Federal Register matching notice

The published notice that announces each matching program to the public, with its publication date and citation. Assessors compare the notice against the agreement and the Data Integrity Board record to confirm they describe the same program. Keep a copy of the published notice alongside the internal record and check that any change to purpose, data or participants has a matching update, or a new notice where the change requires one.

Independent verification records

Documents showing how results from a matching run were checked before any adverse action, including who performed the verification, the data sources compared and the outcome for each flagged record. Where independent verification is required, the record must show it was done by a party other than the one that produced the match. Keep verification logs linked to the matching run identifier so an assessor can trace a single finding from match to decision.

Adverse-action notices and contest logs

Notices sent to individuals before any adverse action, along with a log of every contest received, the reviewer's decision and the date it was resolved. Assessors test whether individuals were told of the finding and given an opportunity to respond before action was taken. Verify that notice templates match the approved agreement, that delivery dates are recorded and that no adverse action appears in case files without a corresponding notice and contest window.

Contracts with the other party

Contracts, data sharing terms and service agreements with the other agencies, vendors or processors that receive or supply data for a matching program. These show who is responsible for data quality, security and retention outside your own boundary. Maintain a register of active matching programs that lists each agreement, its counterparty, its review date and its status, so the full set can be produced quickly for an assessment or an Inspector General inquiry.

What meeting PT-8 costs in money and effort

This table breaks the effort of a PT-8 computer matching program into its cost components, showing who does the work, whether each cost is one-time or recurring, and what pushes it up or down. The NIST facts give no cost figures, so use the table to structure your quote requests and internal budgeting rather than as a price estimate.

Cost component	Who is typically involved	One-time or recurring	What drives it up or down
Legal and privacy office review	Agency or organization counsel and privacy office	One-time per program, with periodic review	Number of matching programs, novelty of data sources, and how closely existing agreements can be reused
Data Integrity Board time	Board members and secretariat staff	Recurring per program cycle	Number of programs submitted, completeness of the package, and how many revisions the Board requests
Drafting the matching agreement and Federal Register notice	Program owners, counsel and records staff	One-time per program, renewed when terms change	Complexity of data elements, number of parties, and whether a standard template applies
Engineering for the comparison workflow	Platform and data engineers, often with an implementation partner	One-time build, then recurring maintenance	Number of data sources, matching logic complexity, and degree of automation in the comparison
Adverse action and contest workflow	Case managers, notification staff and engineers building the case queue	One-time build, recurring operation	Volume of adverse actions, notice timing rules, and how contest responses are logged and routed
Independent verification staff time	Staff trained to verify matches before adverse action	Recurring with each matching run	Match volume, error rates found in past runs, and whether verification can be sampled or must be complete
Evidence upkeep and assessor sampling	Compliance staff and system owners preparing records for assessors	Recurring, usually tied to assessment cycles	Number of programs in scope, retention of run logs and notices, and how much evidence is generated automatically

Who owns PT-8, what partners prepare and what the auditor decides

The organization running a matching program owns PT-8 in full. Under the Privacy Act, the Data Integrity Board, the matching agreement, the Federal Register notice and every decision about whether a match leads to adverse action are organizational responsibilities. No partner or assessor can make those decisions on the organization's behalf, so the organization must be able to show who decided what and when.

Data Integrity Board approval: The board reviews the proposed program and records its determinations. The organization keeps the approval record and any conditions attached to it.
Computer matching agreement: Legal and privacy staff negotiate, sign and maintain the agreement with each participating party, including the purposes, data elements and retention terms.
Federal Register notice: The organization drafts and publishes the matching notice and keeps a copy with the program file.
Adverse action decisions: Program staff decide, after independent verification where required, whether a finding leads to adverse action, and they document the basis for each decision.
Individual notice and contest process: The organization sends notice to affected individuals and runs the process that lets them contest findings before action is taken.

Before the assessment, confirm that each of these records has a named owner and a storage location that outlasts the matching cycle.

Where PT-8 programs usually fall short

Computer matching programs under PT-8 depend on paperwork that keeps moving after the match is approved: agreements, notices, verification steps and data inventories. The gaps below are the ones assessors most often find when they examine the approvals and test the process against the matching program as it actually runs.

Agreements not reviewed after renewal

A matching agreement is usually approved once and then renewed or extended without anyone rechecking its terms against the current data flow. Over time the agreement can drift from what the program does. Fix it by setting a review step at every renewal date, comparing the agreement's purposes, data elements and parties with the live match, and routing any difference back to the Data Integrity Board before the next run.

Federal Register notice not matched to the program

The matching notice published in the Federal Register may describe an earlier version of the program, a different population or fewer data sources than the match now uses. An assessor will compare the notice with the examined records. Fix it by reading the published notice side by side with the current agreement and the operating procedure, and by recording any gap that would require a new notice.

Verification skipped for adverse actions

Where the program requires independent verification before adverse action, teams sometimes act on the raw match hit because the result looks conclusive. Fix it by building a hard checkpoint into the case workflow that blocks any benefit reduction, denial or recovery until a documented verification step is complete, and by keeping the verification record with the case file.

Contest notices sent after the adverse action

Individuals must receive notice of the findings and a chance to contest them before adverse action is taken. Some programs send the notice as a routine letter after the decision has already been recorded, which defeats the purpose. Fix it by sequencing the notice, the response window and the decision in the workflow, and by testing that the decision cannot be recorded before the contest period closes.

No inventory of matched datasets

Many programs cannot say exactly which datasets, fields and personal records flow into each match, especially when extracts are reused for other purposes. Without that inventory, the agreement, the notice and the privacy impact assessment cannot be checked against reality. Fix it by maintaining a dataset register per match that lists sources, data elements, recipients, retention and the owning Data Integrity Board decision.

PT-8 questions buyers ask before bringing in help

How much effort does PT-8 computer matching take to implement?

Effort depends mainly on how many matching programs the organization runs, how many systems and data sets each one touches, and how much documentation already exists. No researched figure is available for this, so treat any number from a vendor with caution and ask for it in writing. For each matching program, the organization must obtain Data Integrity Board approval, negotiate a computer matching agreement, prepare a Federal Register notice, and build a process for independent verification and individual notice. Each of these steps is one-time for a given program but recurs when the agreement is renewed or the matching purpose changes. Ask any partner to break its quote into these steps so you can see which parts are yours and which are theirs.

How long does PT-8 preparation take under SP 800-53?

NIST does not set an implementation timeline for SP 800-53 controls. The governing reference for federal implementation timing is OMB Circular A-130, so check that document and your agency's own schedule before you commit to dates. Timing for PT-8 is driven by the Data Integrity Board's meeting cycle, the negotiation of the matching agreement with the other party, and the lead time for the Federal Register notice. Those external steps often set the critical path more than the technical work does. Ask any partner to tie its schedule to these gates rather than to an abstract number of weeks.

What does PT-8 need from our own staff?

PT-8 depends on decisions and records that only the organization can make. Expect to need staff who own the privacy program, the Data Integrity Board or its equivalent, the system owners of each source and receiving system, legal counsel who reviews the agreement, and the records team that keeps the matching documentation. The assessment procedure for PT-8 asks assessors to examine the privacy notice, Privacy Act system of records, Federal Register notices, Data Integrity Board determinations and contracts, and to interview personnel with PII processing and transparency responsibilities. Those people and documents must be available and accurate for the assessment.

Can our own team implement PT-8 without outside help?

Yes, if your privacy, legal and system owner staff have capacity and the program is small. The work is largely governance and documentation, so the main test is whether the people who must approve the matching program can do so on schedule. Outside help is more useful when the organization runs many matching programs, when systems are poorly documented, or when staff have not operated a matching program before. An implementation partner can prepare system documentation, map data flows, assemble evidence and build repeatable templates. Decide before the engagement which decisions stay with your staff.

What can an implementation partner sign for PT-8?

An implementation partner cannot sign the matching agreement, approve the program, or certify that PT-8 is met. Those acts belong to the organization's own officials, such as the Data Integrity Board members and agreement signatories. A partner can draft documentation for your review, prepare the evidence set, configure systems that log and track matching activity, and support staff through the assessment. DeployOpen prepares systems, controls and evidence for compliance assessments, and it does not issue audit reports, attestations or certifications. Put these boundaries in the written scope before work starts.

How does assessor independence limit what a partner can do?

An assessor must be independent of the work it evaluates, so a partner that prepares the evidence cannot also decide whether PT-8 is satisfied. Under FISMA, Inspectors General independently assess agency system security and report to OMB, and other organizations rely on independent assessors in the same way. The partner's role is to make the evidence clear, complete and traceable to each determination statement, then step back. Ask any partner how it separates preparation from assessment and who on your side will receive the assessor's findings.

How open-source tooling supports PT-8 evidence

No open-source tool is named in the supplied facts for PT-8, so this section does not recommend one. What the assessment needs is clear enough to plan for: a record of each matching program that shows the Data Integrity Board approval, the computer matching agreement, the Federal Register matching notice, the results of any independent verification, and the notice and opportunity to contest given to individuals before adverse action. SP 800-53A Rev. 5 frames these as documents an assessor examines, supported by interviews with the people who run the processing and tests of the processes that carry it out. Any platform you consider should be able to hold these records as versioned, dated and attributable artifacts, and to log each matching run with its inputs, the agreement under which it ran and who authorized it.

Before selecting self-hosted platforms, confirm with each candidate vendor or project, and in your own test environment, whether it can do four things: retain matching run logs with enough detail to reconstruct a run, keep agreements and Data Integrity Board determinations under version control with approval history, hold the adverse-action record including the notice sent, the response window and any contest outcome, and restrict who can start a matching run or change its parameters. Where a platform cannot do this natively, the gap usually sits in a controlled document repository or case management system outside the matching tool. Agree with your privacy office and assessor, in writing, which system is the system of record for each artifact before implementation starts.

How DeployOpen prepares PT-8 systems and evidence

DeployOpen works on PT-8 as an implementation partner: we prepare the systems, records and evidence that a matching program needs, inside the client's own infrastructure. The organization keeps ownership of the Data Integrity Board decisions, matching agreements and notices, and independent assessors or auditors issue any findings.

How we scope

Confirm with counsel and the privacy office which matching programs exist and whether each one falls under the Privacy Act.
Agree in writing which systems, data flows and Federal Register notice records are in scope for PT-8.
Identify the named owners for Data Integrity Board submissions, matching agreements and adverse action notices.
Engagements are fixed-scope, so scope, deliverables and timelines are agreed before work starts.

How we build

Configure self-hosted systems so matched records are tagged with their source, purpose and matching program reference.
Build logging of match runs, inputs, outputs and verification steps so each result can be traced to its agreement.
Set up a documented workflow that holds results for independent verification before any adverse action step.
Test the notice and contest workflow end to end using illustrative match results before production use.

How we hand over

Deliver a control implementation record for PT-8 mapped to the seven SP 800-53A determination statements.
Provide an evidence index listing the agreements, Data Integrity Board determinations and notices a reviewer would examine.
Document the procedures staff follow to run, verify and contest a matching program, with named responsibilities.
Walk the client's assessors through the evidence package, while the organization remains responsible for its own determinations.

How we support

Offer ongoing support and retainers for changes to matching programs, systems or the evidence record.
Review the PT-8 record when a new matching agreement, data source or Federal Register notice is introduced.
Track NIST release changes to SP 800-53 and SP 800-53A that affect PT-8 and recommend updates to the record.
Confirm the scope of any retainer in writing so responsibilities for future changes remain clear.