Privacy Continuous Monitoring Strategy

Approval #

The Senior Agency Official for Privacy (SAOP) approves this privacy document. The Chief Information Security Officer (CISO) concurs on the security controls it relies on.

Revision History #

Review cycle: Every year, and after a change that affects privacy risk.

Mandate. Office of Management and Budget (OMB) Circular A-130, Appendix I, requires the SAOP to develop and maintain a privacy continuous monitoring strategy and program. Circular A-130 defines the strategy as a formal document that catalogs the privacy controls in place at the Organization. It assigns each control an assessment frequency that keeps the Organization compliant and manages privacy risk. This strategy works alongside the information security continuous monitoring strategy (PLAN-ISCM-001).

1. Purpose #

The privacy continuous monitoring program keeps the SAOP aware of privacy risks at all times. It watches for changes to systems and their environments that affect personally identifiable information (PII). It assesses privacy controls often enough to show that they work and that the Organization meets its privacy requirements.

2. Control Catalog and Assessment Frequency #

The SAOP keeps the full catalog of privacy controls in the governance, risk, and compliance (GRC) system. For each privacy control, the SAOP records whether it is a program management, common, system-specific, or hybrid control, and how often it is assessed. The frequencies below are the Organization’s defaults. The SAOP may set a shorter frequency for a system with higher privacy risk.

3. Assessment Methods and Measures #

Assessors examine documents, interview the people who carry out each control, and test system controls, as National Institute of Standards and Technology (NIST) SP 800-53A describes. The SAOP tracks these measures every quarter:

• the share of systems that handle PII with a current privacy impact assessment (PIA);
• the share of systems of records with a current system of records notice (SORN) that carries the breach routine uses;
• the share of the workforce that completed privacy training on time;
• the number of breaches, and the time from discovery to the Cybersecurity and Infrastructure Security Agency (CISA) report and to notification;
• the number of open privacy weaknesses and how many are past due.

Entry criteria: A privacy control is due for assessment.

Exit criteria: Each control due has a recorded result.

The privacy officer gathers the measures at the end of each quarter.

Entry criteria: A quarter ends.

Exit criteria: The SAOP reviewed the measures and decided on any action.

Evidence: the assessment schedule and results in the GRC system, the document review notes, the training completion report, the breach report, and the quarterly measures reports.

4. Watching for Change #

System Owners tell the privacy officer before any change that affects PII. Such changes include a new collection, a new use or sharing of PII, a new system or technology, or a change in the people whose PII the system holds. The privacy officer decides whether the change needs a new or updated PIA, SORN, or privacy notice. The CISO tells the SAOP about any incident, vulnerability, or monitoring finding that puts PII at risk.

Entry criteria: A System Owner plans a change that affects PII, or a finding puts PII at risk.

Exit criteria: The privacy documents match the change before it goes into production, and the SAOP knows of the finding.

Evidence: the change requests with the privacy decisions, the updated PIAs, SORNs, and notices, and the notices to the SAOP.

5. Reporting and Correcting Weaknesses #

Assessors record privacy control weaknesses in the GRC system. The System Owner opens a plan of action and milestones (POA&M) item for each weakness, as the POA&M Management Procedure (PROC-POAM-001) describes. The SAOP reviews open privacy weaknesses every quarter and reports privacy program status to the Agency Head every year. The SAOP uses the results in the annual Federal Information Security Modernization Act (FISMA) privacy report.

Entry criteria: An assessment finds a privacy control weakness.

Exit criteria: The weakness has a POA&M item, and the SAOP reported it in the quarterly review and the annual report.

Evidence: the weakness records and POA&M items in the GRC system, the quarterly review notes, the annual status report, and the FISMA privacy report.

6. Review #

The SAOP reviews this strategy every year and after a change in law, OMB policy, or the Organization’s systems that affects privacy risk.

7. References #

These are the sources this document cites, with a link to each official text.

• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• NIST SP 800-53A Rev. 5: Assessing Security and Privacy Controls, January 2022.
• Privacy Act of 1974 (5 U.S.C. § 552a), December 31, 1974.