The text of the Privacy Program Plan
Approval #
The Senior Agency Official for Privacy (SAOP) approves this privacy document. The Chief Information Security Officer (CISO) concurs on the security controls it relies on.
| Role | Name | Signature |
|---|---|---|
| Senior Agency Official for Privacy (SAOP) | ||
| Chief Information Security Officer (CISO), concurring |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, and after a change in law, federal privacy policy, or program structure.
Mandate. Office of Management and Budget (OMB) Circular A-130, Appendix I, requires the SAOP to develop and maintain a privacy program plan. The plan gives an overview of the privacy program: its structure, its resources, the roles of privacy officials and staff, its goals, and the controls that meet privacy requirements. National Institute of Standards and Technology (NIST) SP 800-53 PM-18 requires the same plan. OMB M-16-24 sets the SAOP’s role and authority.
1. Program Structure and Roles #
The Agency Head designates the SAOP in writing, as OMB M-16-24 requires. The SAOP has the authority, independence, and resources to run the privacy program across the Organization. The SAOP coordinates with the Chief Information Officer (CIO) and the CISO on every requirement in this plan.
| Role | Responsibility |
|---|---|
| SAOP | Accountable for the privacy program; approves privacy policy; reviews privacy risk in authorizations; directs breach response under PLAN-BR-001 |
| Chief Privacy Officer | Runs the privacy program day to day for the SAOP |
| Privacy Act Officer | Handles Privacy Act requests, system of records notices (SORNs), and Privacy Act reports |
| Privacy officers | Support System Owners with privacy impact assessments (PIAs), notices, and privacy controls |
| Data Integrity Board | Reviews and approves each computer matching agreement, when the Organization runs matching programs |
| CISO | Protects personally identifiable information (PII) through the security program and reports privacy incidents to the SAOP |
| System Owners | Carry out privacy controls for their systems and keep each system’s privacy documents current |
The SAOP records the names of the people in these roles in the table below and updates it when a role changes.
| Role | Name | Since |
|---|---|---|
| SAOP | [Name, title] | [Date of written designation] |
| Chief Privacy Officer | [Name] | [Date] |
| Privacy Act Officer | [Name] | [Date] |
2. Resources #
The SAOP records the staff and funding the privacy program has and needs. The SAOP reviews IT capital investment plans and budget requests for any system that handles PII. The review confirms that each plan names the privacy requirements, the privacy controls, and their costs.
| Resource | Current year | Next year request |
|---|---|---|
| Privacy staff (full-time equivalents) | [Number] | [Number] |
| Privacy program budget | [Amount] | [Amount] |
| Contract support | [Description] | [Description] |
3. Goals and Objectives #
The SAOP sets the program’s goals for each year and reports progress in the annual Federal Information Security Modernization Act (FISMA) privacy report. The standing goals are:
- Process PII only as law authorizes and only for stated purposes.
- Keep PII to the minimum the Organization needs, and remove unnecessary use of Social Security numbers.
- Keep every SORN, PIA, and privacy notice current and published.
- Detect, report, and respond to every breach of PII under PLAN-BR-001.
- Train every person who handles PII, and give role-based privacy training to those with privacy duties.
4. Privacy Controls #
The SAOP decides which privacy controls are program management controls, common controls, system-specific controls, or hybrid controls. The SAOP records each decision in the governance, risk, and compliance (GRC) system. The SAOP provides the program management and common controls below to every system.
| Control | What the program provides | Owner |
|---|---|---|
| PM-18 Privacy Program Plan | This plan, reviewed every year | SAOP |
| PM-19 Privacy Program Leadership Role | The SAOP designation and the roles in this plan | Agency Head |
| PM-20 Dissemination of Privacy Program Information | A privacy program page on the Organization’s public website | Chief Privacy Officer |
| PM-20(1) Privacy Policies on Websites, Applications, and Digital Services | A privacy policy linked from every public website, application, and digital service | Chief Privacy Officer |
| PM-05(1) Inventory of Personally Identifiable Information | An inventory of the PII each system holds, reviewed every year | Privacy Act Officer |
| PM-22 Personally Identifiable Information Quality Management | Rules for keeping PII accurate, relevant, timely, and complete | SAOP |
| PM-25 Minimization of PII Used in Testing, Training, and Research | Approval before PII is used for testing, training, or research | SAOP |
| PM-27 Privacy Reporting | The annual FISMA privacy report and other reports OMB and Congress require | SAOP |
| PT-01 Policy and Procedures | The PII processing and transparency policy | SAOP |
| PT-06 System of Records Notice | Published SORNs with the breach routine uses that OMB M-17-12 requires | Privacy Act Officer |
| PT-07(1) Social Security Numbers | Review of every collection of Social Security numbers and removal of unnecessary use | Chief Privacy Officer |
| PT-08 Computer Matching Requirements | Matching agreements approved by the Data Integrity Board and published as the Privacy Act requires | Privacy Act Officer |
| RA-08 Privacy Impact Assessments | A PIA before the Organization develops or buys a system that handles PII | Privacy officers |
5. Privacy Responsibilities in the Security Program #
Under Circular A-130, the SAOP takes part in risk management for every system that handles PII. The SAOP:
- reviews and approves the Federal Information Processing Standards (FIPS) 199 categorization of each system that handles PII;
- reviews and approves each system’s privacy plan before authorization, reauthorization, or ongoing authorization;
- reviews the authorization package before the Authorizing Official decides whether to accept the risk;
- runs the privacy continuous monitoring program under PLAN-PCM-001.
6. Privacy Act and Public Notice #
The Privacy Act Officer publishes, revises, and rescinds SORNs as OMB Circular A-108 requires, through these steps:
- When a new system of records is planned, or an existing one changes significantly, the System Owner tells the Privacy Act Officer.
- The Privacy Act Officer drafts the new or revised SORN, and the SAOP approves it.
- The Privacy Act Officer reports the SORN to OMB and Congress at least 30 days before sending it to the Federal Register.
- After that review period, the Privacy Act Officer publishes the SORN in the Federal Register.
- The Privacy Act Officer posts the current SORN on the privacy program page.
The privacy continuous monitoring program, described in the Privacy Continuous Monitoring Strategy, keeps each SORN accurate, current, and properly scoped. The Privacy Act Officer also prepares the Privacy Act reports A-108 requires.
When the Organization takes part in a computer matching program, the Data Integrity Board reviews and approves each matching agreement before matching starts. At the end of each calendar year, the Board reviews that year’s matching programs and reports to the Agency Head and OMB.
The Chief Privacy Officer keeps a privacy program page at the Organization’s /privacy web address. The page lists every system of records and links to the current version of each SORN.
7. Public Websites and Digital Services #
The Chief Privacy Officer makes sure every public website and digital service meets these OMB requirements:
- Privacy policy (OMB M-03-22). A privacy policy is posted or linked on the principal website, at each major entry point, and on any page that collects substantial PII. The policy covers consent to collection and sharing and people’s rights under the Privacy Act.
- Web measurement and customization (OMB M-10-22). The Organization uses cookies and similar technologies only in ways that are easy to opt out of, never tracks people across other websites, and requires opt-in for the most intrusive uses. The privacy policy names each technology. The Chief Privacy Officer reviews these uses every year and posts the results on the Organization’s /open page.
- America.gov (Executive Order 14432). When the Organization connects a covered public service to America.gov, it keeps custody and control of its own records. The connection must not create a central federal system of records about the public. The Chief Privacy Officer reviews each connection before it goes live and confirms data minimization, secure sign-in, and disclosure only as the Privacy Act allows. The Privacy Act Officer updates the PIA and any SORN the connection affects.
- Third-party websites and applications (OMB M-10-23). The privacy policy describes each third-party website or application the Organization uses. Where feasible, a privacy notice appears on the third-party page. An adapted PIA covers each use that makes PII available to the Organization. Links to non-government websites carry an alert that the visitor is leaving the Organization’s site.
8. Requests for Records #
The Privacy Act Officer answers each request for records under the Privacy Act through these steps:
- When a request arrives, the Privacy Act Officer logs it with the date received.
- The Privacy Act Officer verifies the requester’s identity. For a digital request, the Privacy Act Officer uses remote identity proofing and authentication that meet NIST SP 800-63-4, as OMB M-21-04 requires.
- The Privacy Act Officer asks the System Owner for the records and reviews them for exemptions.
- The Privacy Act Officer sends the response and records the date in the log.
The Organization offers a digital way to request records. It accepts consent to disclose records from people verified this way.
9. Training #
Every person who handles PII completes privacy awareness training before receiving access and every year after. People with privacy duties, including Privacy Act and matching program officials, complete role-based privacy training every year. The SAOP approves the training content.
10. Review #
The SAOP reviews this plan every year and after any change in law, OMB policy, or the program’s structure. The SAOP records the date of each review.
11. References #
These are the sources this document cites, with a link to each official text.
- Executive Order 14432: Streamlining Access to Government Services Through America.gov, September 29, 2026.
- Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
- NIST SP 800-63-4: Digital Identity Guidelines, July 31, 2025.
- OMB Circular A-108: Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act, December 23, 2016.
- OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
- OMB M-03-22: OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, September 26, 2003.
- OMB M-10-22: Guidance for Online Use of Web Measurement and Customization Technologies, June 25, 2010.
- OMB M-10-23: Guidance for Agency Use of Third-Party Websites and Applications, June 25, 2010.
- OMB M-16-24: Role and Designation of Senior Agency Officials for Privacy, September 15, 2016.
- OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
- OMB M-21-04: Modernizing Access to and Consent for Disclosure of Records Subject to the Privacy Act, November 12, 2020.
- Privacy Act of 1974 (5 U.S.C. § 552a), December 31, 1974.