Personally Identifiable Information Processing and Transparency Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the Senior Agency Official for Privacy (SAOP) sets the Organization’s requirements for personally identifiable information processing and transparency in every information system that the Organization operates or that others operate for it. The SAOP issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers how the Organization processes personally identifiable information (PII). The Organization holds PII as a steward under the Privacy Act and OMB A-130. Every processing of PII must have a documented legal authority and purpose. The Organization must assess privacy risk through Privacy Impact Assessments (PIAs) and keep its System of Records Notices current and accurate. It must build consent and transparency obligations into its systems, in partnership with the SAOP.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The SAOP tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• PR.DS — Data Security (Protect function)

These categories fall under the Protect function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every personally identifiable information processing and transparency control in the moderate baseline of FIPS 200 and NIST SP 800-53B:

• PT-01 — Policy and Procedures
• PT-02 — Authority to Process Personally Identifiable Information
• PT-03 — Personally Identifiable Information Processing Purposes
• PT-04 — Consent
• PT-05 — Privacy Notice
• PT-05(2) — Privacy Act Statements
• PT-06 — System of Records Notice
• PT-06(1) — Routine Uses
• PT-06(2) — Exemption Rules
• PT-07 — Specific Categories of Personally Identifiable Information
• PT-07(1) — Social Security Numbers
• PT-07(2) — First Amendment Information
• PT-08 — Computer Matching Requirements

2. Authority and References #

The SAOP issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• Privacy Act of 1974 (5 U.S.C. § 552a), December 31, 1974.
• E-Government Act of 2002 (Pub. L. 107-347), December 17, 2002.
• OMB Circular A-108: Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act, December 23, 2016.
• OMB M-03-22: OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, September 26, 2003.
• OMB M-16-24: Role and Designation of Senior Agency Officials for Privacy, September 15, 2016.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• OMB M-10-22: Guidance for Online Use of Web Measurement and Customization Technologies, June 25, 2010.
• OMB M-10-23: Guidance for Agency Use of Third-Party Websites and Applications, June 25, 2010.
• OMB M-21-04: Modernizing Access to and Consent for Disclosure of Records Subject to the Privacy Act, November 12, 2020.
• OMB M-25-32: Preventing Improper Payments and Protecting Privacy Through Do Not Pay, August 20, 2025.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the PT control family. They add to the NIST SP 800-53 control requirements in the Policy section.

OMB M-25-32: Preventing Improper Payments and Protecting Privacy Through Do Not Pay

• The organization must disclose to Treasury’s Do Not Pay system only the data elements needed to find, prevent, or recover improper payments, and only under a written data-sharing agreement that states security procedures. (OMB M-25-32; 5 U.S.C. § 552a)
• The organization should have the Senior Agency Official for Privacy keep the Do Not Pay routine use in each system of records notice that covers applicants for or recipients of federal funds. Deadline: Initial review due 2025-09-19. (OMB M-25-32)

OMB Circular A-130: Managing Information as a Strategic Resource

• The organization must eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to using them as personal identifiers. (OMB Circular A-130, §5(f)(1)(f))

OMB M-03-22: OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002

• The organization must conduct a privacy impact assessment before developing or procuring an IT system that collects, maintains, or disseminates information in identifiable form, and post a privacy policy on the principal website, at major entry points, and on any page that collects substantial information in identifiable form. (OMB M-03-22, Attachment A §§ II.B, III)

OMB M-10-22: Guidance for Online Use of Web Measurement and Customization Technologies

• The organization must use web measurement and customization technologies only in ways the public can easily opt out of, never to track individual activity outside the website, name them in the online privacy policy, and review their use every year. (OMB M-10-22, Attachment 1)

OMB M-21-04: Modernizing Access to and Consent for Disclosure of Records Subject to the Privacy Act

• The organization must offer a digital way to request access to Privacy Act records, verify each requester through remote identity proofing and authentication that conform to NIST SP 800-63, and accept consent forms from people verified this way. Deadline: 2021-11-12 (one year after 2020-11-12). (OMB M-21-04)

OMB Circular A-108: Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act

• The organization must report each new or significantly modified system of records notice to OMB and Congress at least 30 days before submitting it to the Federal Register, and list and link every current notice on the agency privacy program page. (OMB Circular A-108, §§ 7, 15)
• The organization should have the Data Integrity Board review each calendar year’s computer matching programs and report the results to the Agency Head and OMB. (OMB Circular A-108, §14)

OMB M-10-23: Guidance for Agency Use of Third-Party Websites and Applications

• The organization should describe each third-party website or application in the privacy policy, post a privacy notice on the third-party page where feasible, and complete an adapted privacy impact assessment when a use makes PII available to the Organization. (OMB M-10-23, Section 4)

3. Policy #

The Organization must implement and maintain its personally identifiable information processing and transparency controls to meet the following requirements:

PT-01 — Policy and Procedures #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] personally identifiable information processing and transparency policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures; and
3. Review and update the current personally identifiable information processing and transparency:

1. Policy [Assignment: organization-defined frequency — to be defined] and following [Assignment: organization-defined events — to be defined]; and
2. Procedures [Assignment: organization-defined frequency — to be defined] and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The agency head designates [PT-01 parameter 4 — to be defined] to manage the development, documentation, and distribution of this policy and its procedures. This [PT-01 parameter 3 — to be defined] governs how the Organization collects, uses, shares, keeps, and disposes of personally identifiable information (PII), and how it tells the public about that processing. It applies to all personnel, contractors, and systems that handle PII. The Senior Agency Official for Privacy (SAOP) must coordinate it with the Chief Information Security Officer (CISO) so security and privacy requirements agree.

System Owners must complete a privacy threshold analysis, and then a privacy impact assessment where needed, before they develop or buy IT that handles PII, as OMB M-03-22 requires. The SAOP must report each new or significantly changed system of records notice to OMB and Congress under OMB Circular A-108. The SAOP must also post a website privacy policy that meets OMB M-10-22 and M-10-23.

The SAOP must send this policy and its procedures to [PT-01 parameter 1 — to be defined]. The SAOP must review and update the policy [PT-01 parameter 5 — to be defined] and after [PT-01 parameter 6 — to be defined]. The SAOP must review and update the procedures [PT-01 parameter 7 — to be defined] and after [PT-01 parameter 8 — to be defined].

PT-02 — Authority to Process Personally Identifiable Information #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

Requirement:

1. Determine and document the [Assignment: organization-defined authority — to be defined] that permits the [Assignment: organization-defined processing — to be defined] of personally identifiable information; and
2. Restrict the [Assignment: organization-defined processing — to be defined] of personally identifiable information to only that which is authorized.

Implementation guidance:

The Organization processes personally identifiable information (PII) only under [PT-02 parameter 1 — to be defined]. The Senior Agency Official for Privacy (SAOP) must keep a written record of the legal authority for each program and system that handles PII. The General Counsel must confirm each authority before the processing starts. System Owners must complete a privacy threshold analysis, and a privacy impact assessment when the analysis requires one, before they develop or buy a system that handles PII, as OMB M-03-22 requires. Each system must limit its [PT-02 parameter 2 — to be defined] of PII to the uses the documented authority allows. Staff must not use PII for any purpose outside that authority. Any new use, new data element, or new sharing partner needs SAOP approval before it begins. The SAOP must apply the same limit to [PT-02 parameter 3 — to be defined] of PII by contractors and partners through contracts and written sharing agreements.

PT-03 — Personally Identifiable Information Processing Purposes #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

Requirement:

1. Identify and document the [Assignment: organization-defined purpose(s) — to be defined] for processing personally identifiable information;
2. Describe the purpose(s) in the public privacy notices and policies of the organization;
3. Restrict the [Assignment: organization-defined processing — to be defined] of personally identifiable information to only that which is compatible with the identified purpose(s); and
4. Monitor changes in processing personally identifiable information and implement [Assignment: organization-defined mechanisms — to be defined] to ensure that any changes are made in accordance with [Assignment: organization-defined requirements — to be defined].

Implementation guidance:

System Owners must state each purpose for which a system handles personally identifiable information (PII) as [PT-03 parameter 1 — to be defined]. The Senior Agency Official for Privacy (SAOP) must approve each stated purpose before the system collects any PII. The SAOP must publish each purpose in the Organization’s privacy notices, system of records notices, and website privacy policy, as OMB M-03-22 requires for the posted policy. Each system must limit its [PT-03 parameter 2 — to be defined] of PII to uses that match an approved purpose. Staff must not use PII for an unrelated purpose. System Owners must report any planned change in processing to the Privacy Officer before the change goes into effect. The Privacy Officer must review each change through [PT-03 parameter 3 — to be defined] and must confirm the change meets [PT-03 parameter 4 — to be defined].

PT-04 — Consent #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

Requirement:

Implement [Assignment: organization-defined tools or mechanisms — to be defined] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.

Implementation guidance:

Before a system collects personally identifiable information (PII), the System Owner must give each person a way to agree or decline through [PT-04 parameter 1 — to be defined]. The consent request must state in plain words what the Organization collects, why, who receives it, and what happens if the person declines. The Senior Agency Official for Privacy (SAOP) must approve the wording of each consent request. The person must decide before the system collects the data. When a person declines, the System Owner must stop the collection for that person and keep a record of the choice. A person who agreed must be able to withdraw that agreement later. The System Owner must honor the withdrawal for any further processing. People who prove identity online under OMB M-21-04 may give consent digitally, and the Organization must accept that consent.

PT-05 — Privacy Notice #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

Requirement:

Provide notice to individuals about the processing of personally identifiable information that: a. Is available to individuals upon first interacting with an organization, and subsequently at [Assignment: organization-defined frequency — to be defined]; b. Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language; c. Identifies the authority that authorizes the processing of personally identifiable information; d. Identifies the purposes for which personally identifiable information is to be processed; and e. Includes [Assignment: organization-defined information — to be defined].

Implementation guidance:

The Organization must give people a privacy notice when they first deal with the Organization and again [PT-05 parameter 1 — to be defined]. The Senior Agency Official for Privacy (SAOP) owns the content of every privacy notice. System Owners must place the notice where people provide their data. Each notice must use plain language and must name the legal authority for the processing and each purpose. Each notice must also include[PT-05 parameter 2 — to be defined]. The Privacy Officer must post a privacy policy on the Organization’s main website, at major entry points, and on any page that collects a large amount of personal data, as OMB M-03-22 requires. The privacy policy must name any web measurement tools and describe each third-party website or application the Organization uses, as OMB M-10-22 and M-10-23 require. The SAOP must update a notice whenever the authority, purposes, or disclosures change.

PT-05(2) — Privacy Act Statements #

Baselines: Privacy

Requirement:

Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.

Implementation guidance:

When a form collects information that the Organization will keep in a Privacy Act system of records, the System Owner must include a Privacy Act statement on that form. The System Owner may instead give the statement on a separate page that the person can keep. The statement must name the legal authority, the purpose, the routine uses, and whether giving the information is mandatory or voluntary. The statement must also say what happens if the person does not provide it. The Privacy Officer must review each statement against the system of records notice, and the Senior Agency Official for Privacy (SAOP) must approve it.

PT-06 — System of Records Notice #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

Requirement:

For systems that process information that will be maintained in a Privacy Act system of records: a. Draft system of records notices in accordance with OMB guidance and submit new and significantly modified system of records notices to the OMB and appropriate congressional committees for advance review; b. Publish system of records notices in the Federal Register; and c. Keep system of records notices accurate, up-to-date, and scoped in accordance with policy.

Implementation guidance:

The Senior Agency Official for Privacy (SAOP) must make sure each Privacy Act system of records has a current system of records notice. The Privacy Officer must draft each notice under OMB Circular A-108. The SAOP must send each new or significantly changed notice to OMB and to Congress at least 30 days before submitting it to the Federal Register, as Circular A-108 requires. The Privacy Officer must then publish the notice in the Federal Register. The SAOP must list and link every current notice on the Organization’s privacy program web page. Each notice that covers applicants for or recipients of federal funds must keep the Do Not Pay routine use, as OMB M-25-32 requires. System Owners must tell the Privacy Officer about any change that affects a notice’s accuracy or scope.

PT-06(1) — Routine Uses #

Baselines: Privacy

Requirement:

Review all routine uses published in the system of records notice at [Assignment: organization-defined frequency — to be defined] to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.

Implementation guidance:

The Privacy Officer must review every routine use in each system of records notice[PT-06(1) parameter 1 — to be defined]. The review must confirm that each routine use is accurate. It must also confirm that each disclosure still matches the purpose for which the Organization collected the information. System Owners must report changes in the system that could affect a routine use. The Senior Agency Official for Privacy (SAOP) must approve any change, and must keep the Do Not Pay routine use where OMB M-25-32 requires it.

PT-06(2) — Exemption Rules #

Baselines: Privacy

Requirement:

Review all Privacy Act exemptions claimed for the system of records at [Assignment: organization-defined frequency — to be defined] to ensure they remain appropriate and necessary in accordance with law, that they have been promulgated as regulations, and that they are accurately described in the system of records notice.

Implementation guidance:

The Privacy Officer must review every Privacy Act exemption claimed for each system of records[PT-06(2) parameter 1 — to be defined]. The review must confirm that each exemption is still needed and allowed by law. It must also confirm that the Organization has published the exemption as a regulation and that the system of records notice describes it correctly. The General Counsel must confirm the legal basis for each exemption. The Senior Agency Official for Privacy (SAOP) must approve keeping, changing, or dropping each exemption.

PT-07 — Specific Categories of Personally Identifiable Information #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

Requirement:

Apply [Assignment: organization-defined processing conditions — to be defined] for specific categories of personally identifiable information.

Implementation guidance:

System Owners must identify any special category of personally identifiable information (PII) a system handles. Examples include Social Security numbers, biometric data, and records of how a person exercises First Amendment rights. System Owners must record these categories in the privacy threshold analysis and privacy impact assessment. The Senior Agency Official for Privacy (SAOP) must set [PT-07 parameter 1 — to be defined] for each special category before the system processes it. The System Owner must apply those conditions and record them in the System Security and Privacy Plan (SSPP). The Organization must not process a special category without approved conditions. The SAOP must review the conditions when the system changes or the privacy impact assessment is updated.

PT-07(1) — Social Security Numbers #

Baselines: Privacy

Requirement:

When a system processes Social Security numbers: (a) Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier; (b) Do not deny any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his or her Social Security number; and (c) Inform any individual who is asked to disclose his or her Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.

Implementation guidance:

System Owners must remove any collection, storage, or use of Social Security numbers that the mission does not require, as OMB Circular A-130 directs. System Owners must use another identifier wherever possible. The Organization must not deny any person a right, benefit, or privilege provided by law because the person declines to give a Social Security number. Each form that asks for the number must tell the person whether giving it is mandatory or voluntary. The form must also state the legal authority for the request and how the Organization will use the number. The Senior Agency Official for Privacy (SAOP) must approve each continued use.

PT-07(2) — First Amendment Information #

Baselines: Privacy

Requirement:

Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.

Implementation guidance:

Staff must not collect, keep, or use information that describes how a person exercises First Amendment rights. These rights include religion, speech, the press, assembly, and petition. Three exceptions apply: a statute expressly allows it, the person expressly allows it, or it is relevant to and within the scope of an authorized law enforcement activity. The General Counsel must confirm any exception in writing. The Senior Agency Official for Privacy (SAOP) must approve the exception before the processing starts.

PT-08 — Computer Matching Requirements #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

Requirement:

When a system or organization processes information for the purpose of conducting a matching program: a. Obtain approval from the Data Integrity Board to conduct the matching program; b. Develop and enter into a computer matching agreement; c. Publish a matching notice in the Federal Register; d. Independently verify the information produced by the matching program before taking adverse action against an individual, if required; and e. Provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual.

Implementation guidance:

The Senior Agency Official for Privacy (SAOP) must decide whether each proposed comparison of records with another agency is a matching program under the Privacy Act. If it is, the program office must not start the match until the Data Integrity Board approves it. The Privacy Officer must prepare a written computer matching agreement with each partner, and General Counsel must review it before signature. The SAOP must publish a matching notice in the Federal Register before the first match runs. Disclosures to Treasury’s Do Not Pay system must include only the data needed to find or recover improper payments, under a written agreement that states security procedures, per OMB M-25-32.

No official may deny or reduce a benefit because of a match result until staff verify the result independently where required. The program office must also give the individual notice of the findings and a chance to contest them before acting. The Data Integrity Board must review each calendar year’s matching programs and report the results to the agency head and OMB, as OMB Circular A-108 directs.

Privacy Compliance Documents #

The Senior Agency Official for Privacy (SAOP) decides which privacy compliance documents each system needs, starting from a privacy threshold analysis. The documents are the privacy impact assessment (PIA), the system of records notice (SORN), and the Privacy Act statement.

• The System Owner must complete a privacy threshold analysis before developing or buying a system, and again when the system adds a new category of PII.
• The SAOP must review each privacy threshold analysis and decide which other documents the system needs.
• The System Owner must complete a PIA before developing or buying information technology that handles PII, under section 208 of the E-Government Act and OMB M-03-22.
• The SAOP must approve each PIA before the Authorizing Official authorizes the system.
• The SAOP must publish a SORN in the Federal Register before the Organization keeps any new system of records. The SAOP must first send a new or significantly changed SORN to OMB and Congress for review under OMB Circular A-108.
• Each SORN must include the two breach routine uses that OMB M-17-12 requires.
• Each form that collects information for a system of records must carry a Privacy Act statement under 5 U.S.C. 552a(e)(3).
• Mission/Business Owners may use web measurement technologies only as OMB M-10-22 allows. They may use third-party websites and applications only as OMB M-10-23 allows.

Source: E-Government Act of 2002, section 208; OMB M-03-22; Privacy Act of 1974, 5 U.S.C. 552a(e)(3), (e)(4), and (e)(11); OMB Circular A-108; OMB M-17-12; OMB M-10-22; OMB M-10-23.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The SAOP manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The SAOP collects and trends the measures and reports them to the agency head, the CIO, and the Authorizing Officials. When a measure moves away from its target, the SAOP starts corrective action through the plan of action and milestones (POA&M) process.

The SAOP keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The SAOP records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of personally identifiable information processing and transparency controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the SAOP improves personally identifiable information processing and transparency through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Automate PII discovery and mapping so privacy documentation reflects actual data flows, not declared ones.

8. Exceptions and Waivers #

The SAOP may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the SAOP a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The SAOP decides each request in coordination with the Authorizing Official. An exception that affects a security control also needs the agreement of the CISO. The SAOP re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• E-Government Act of 2002 (Pub. L. 107-347), December 17, 2002.
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• NIST SP 800-63-4: Digital Identity Guidelines, July 31, 2025.
• OMB Circular A-108: Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act, December 23, 2016.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-03-22: OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, September 26, 2003.
• OMB M-10-22: Guidance for Online Use of Web Measurement and Customization Technologies, June 25, 2010.
• OMB M-10-23: Guidance for Agency Use of Third-Party Websites and Applications, June 25, 2010.
• OMB M-16-24: Role and Designation of Senior Agency Officials for Privacy, September 15, 2016.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• OMB M-21-04: Modernizing Access to and Consent for Disclosure of Records Subject to the Privacy Act, November 12, 2020.
• OMB M-25-32: Preventing Improper Payments and Protecting Privacy Through Do Not Pay, August 20, 2025.
• Privacy Act of 1974 (5 U.S.C. § 552a), December 31, 1974.