Personally Identifiable Information Processing and Transparency Procedure

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose #

The people named in this procedure use it to carry out the PT control family policy (POL-PT). It covers every control in the personally identifiable information processing and transparency family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls. They also support the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics.

This general procedure covers every control in the PT family. A system that departs from it, or adds to it, has its own system-specific procedure for those controls.

2. Scope #

This procedure applies to every information system that the Organization operates, or that others operate for it, under the low security baseline.

2.1 CSF 2.0 Alignment #

The steps in this procedure support these NIST Cybersecurity Framework (CSF) 2.0 categories:

• PR.DS — Data Security (Protect function)

3. Controls Covered #

This procedure covers the following 13 controls in the PT family:

3.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the PT control family. They add to the NIST SP 800-53 control requirements that the Procedure section carries out.

OMB M-25-32: Preventing Improper Payments and Protecting Privacy Through Do Not Pay

• The organization must disclose to Treasury’s Do Not Pay system only the data elements needed to find, prevent, or recover improper payments, and only under a written data-sharing agreement that states security procedures. (OMB M-25-32; 5 U.S.C. § 552a)
• The organization should have the Senior Agency Official for Privacy keep the Do Not Pay routine use in each system of records notice that covers applicants for or recipients of federal funds. Deadline: Initial review due 2025-09-19. (OMB M-25-32)

OMB Circular A-130: Managing Information as a Strategic Resource

• The organization must eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to using them as personal identifiers. (OMB Circular A-130, §5(f)(1)(f))

OMB M-03-22: OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002

• The organization must conduct a privacy impact assessment before developing or procuring an IT system that collects, maintains, or disseminates information in identifiable form, and post a privacy policy on the principal website, at major entry points, and on any page that collects substantial information in identifiable form. (OMB M-03-22, Attachment A §§ II.B, III)

OMB M-10-22: Guidance for Online Use of Web Measurement and Customization Technologies

• The organization must use web measurement and customization technologies only in ways the public can easily opt out of, never to track individual activity outside the website, name them in the online privacy policy, and review their use every year. (OMB M-10-22, Attachment 1)

OMB M-21-04: Modernizing Access to and Consent for Disclosure of Records Subject to the Privacy Act

• The organization must offer a digital way to request access to Privacy Act records, verify each requester through remote identity proofing and authentication that conform to NIST SP 800-63, and accept consent forms from people verified this way. Deadline: 2021-11-12 (one year after 2020-11-12). (OMB M-21-04)

OMB Circular A-108: Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act

• The organization must report each new or significantly modified system of records notice to OMB and Congress at least 30 days before submitting it to the Federal Register, and list and link every current notice on the agency privacy program page. (OMB Circular A-108, §§ 7, 15)
• The organization should have the Data Integrity Board review each calendar year’s computer matching programs and report the results to the Agency Head and OMB. (OMB Circular A-108, §14)

OMB M-10-23: Guidance for Agency Use of Third-Party Websites and Applications

• The organization should describe each third-party website or application in the privacy policy, post a privacy notice on the third-party page where feasible, and complete an adapted privacy impact assessment when a use makes PII available to the Organization. (OMB M-10-23, Section 4)

4. Procedure #

4.1 General Implementation Approach #

The Organization implements the PT controls in two ways: as organization-wide common controls that systems inherit, and as system-specific implementations where a system needs them. The control-specific procedures below cover each control in the Personally Identifiable Information Processing and Transparency family.

The Common Control Provider (CCP) implements controls marked inherited for the whole Organization. The CCP and each System Owner share the work for controls marked hybrid. Each System Owner implements controls marked customer-configured for the system.

Responsible party: The Privacy Officer (SAOP) carries out the steps in this procedure unless a control-specific procedure names someone else. The System Owner is accountable for funding and completing the work. The SAOP oversees the procedure and receives its performance measures. See the PT policy (POL-PT) for the role definitions.

4.2 Control-Specific Procedures #

PT-01 — Policy and Procedures #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] personally identifiable information processing and transparency policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures; and
3. Review and update the current personally identifiable information processing and transparency:

1. Policy [Assignment: organization-defined frequency — to be defined] and following [Assignment: organization-defined events — to be defined]; and
2. Procedures [Assignment: organization-defined frequency — to be defined] and following [Assignment: organization-defined events — to be defined].

Procedure:

The Privacy Officer drafts the policy and procedures for the SAOP. The drafts cover purpose, scope, roles, responsibilities, management commitment, coordination among offices, and compliance. The Privacy Officer asks the Chief Information Security Officer (CISO), General Counsel, and System Owners for comments. The Privacy Officer records each comment and how it was resolved. General Counsel confirms that the drafts are consistent with the Privacy Act, the Office of Management and Budget (OMB) guidance, and other federal requirements.

The SAOP approves the final documents. The Privacy Officer publishes them and sends a notice to the officials named in this policy. The procedures describe the privacy threshold analysis and privacy impact assessment steps, system of records notice reviews, Privacy Act statements on forms, and website privacy notices.

The Privacy Officer starts a review on schedule. A review also starts after a change in law or OMB guidance, an audit finding, or a breach that shows a gap. The Privacy Officer records what changed and why, and the SAOP approves the update.

Evidence: the approved policy and procedures with version history, the comment record, General Counsel’s review, the SAOP’s approval, and the distribution notice.

PT-02 — Authority to Process Personally Identifiable Information #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

1. Determine and document the [Assignment: organization-defined authority — to be defined] that permits the [Assignment: organization-defined processing — to be defined] of personally identifiable information; and
2. Restrict the [Assignment: organization-defined processing — to be defined] of personally identifiable information to only that which is authorized.

Procedure:

The System Owner starts the authority review when a new system, collection, or sharing agreement that involves personally identifiable information (PII) is planned. The System Owner completes a privacy threshold analysis and sends it to the Privacy Officer. The Privacy Officer identifies the statute, regulation, or executive order that permits the processing and asks the General Counsel to confirm it.

If the threshold analysis shows the system handles PII, the System Owner drafts a privacy impact assessment. The assessment names the authority, the data elements, and the permitted uses. The SAOP reviews and signs the assessment before development or purchase begins. The Information System Security Officer (ISSO) records the approved authority and uses in the System Security and Privacy Plan (SSPP).

When a System Owner proposes a new use or a new sharing partner, the Privacy Officer checks it against the recorded authority. A use the authority does not cover stops until the General Counsel and the SAOP approve a revised authority. The Contracting Officer adds the approved limits to each contract or sharing agreement that gives a third party access to PII.

Evidence: the signed privacy threshold analysis, the signed privacy impact assessment, the General Counsel’s authority confirmation, the SSPP privacy section, and the contract or agreement clauses that state the limits.

PT-03 — Personally Identifiable Information Processing Purposes #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

1. Identify and document the [Assignment: organization-defined purpose(s) — to be defined] for processing personally identifiable information;
2. Describe the purpose(s) in the public privacy notices and policies of the organization;
3. Restrict the [Assignment: organization-defined processing — to be defined] of personally identifiable information to only that which is compatible with the identified purpose(s); and
4. Monitor changes in processing personally identifiable information and implement [Assignment: organization-defined mechanisms — to be defined] to ensure that any changes are made in accordance with [Assignment: organization-defined requirements — to be defined].

Procedure:

The System Owner lists each purpose for processing PII in the privacy threshold analysis. If a privacy impact assessment is needed, the System Owner describes each purpose there and links it to the data elements that serve it. The Privacy Officer checks that each data element supports a stated purpose and asks the System Owner to drop elements that do not. The SAOP signs the assessment to approve the purposes.

The Privacy Officer adds the approved purposes to the privacy notice, the system of records notice, and the website privacy policy. The ISSO records the approved purposes in the System Security and Privacy Plan (SSPP).

The System Owner sends each planned change in processing to the Privacy Officer through the change request process. Examples include a new data element, a new use, a new sharing partner, or a new analysis method. The Privacy Officer compares the change with the approved purposes. A change that falls outside them requires an updated privacy impact assessment and SAOP approval before work begins. The Privacy Officer then updates the affected notices.

Evidence: the signed privacy threshold analysis and privacy impact assessment, the published notices with their purpose statements, the SSPP privacy section, and each change request with the Privacy Officer’s decision.

PT-04 — Consent #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

Implement [Assignment: organization-defined tools or mechanisms — to be defined] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.

Procedure:

The System Owner identifies each point where a system collects PII and records it in the privacy impact assessment. For each point, the System Owner drafts a consent request with the Privacy Officer. The request names the data, the purpose, the recipients, and the effect of declining. The Privacy Officer checks the wording for plain language, and the SAOP approves it.

The development team builds the consent request into the form or screen. The request appears before any data entry, and it offers clear accept and decline choices. The ISSO tests the request before the system goes into production. The ISSO confirms that a decline stops the collection and that the system records each choice with a date and time.

When a person withdraws consent, the System Owner stops further processing of that person’s data for the purpose covered. The System Owner then records the withdrawal. The Privacy Officer reviews consent records as part of privacy continuous monitoring. The Privacy Officer opens a corrective action for any form that collects data without a recorded choice.

Evidence: the approved consent wording, the privacy impact assessment entry for each collection point, the ISSO’s test record, consent and withdrawal records, and corrective actions from the Privacy Officer’s reviews.

PT-05 — Privacy Notice #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

Provide notice to individuals about the processing of personally identifiable information that: a. Is available to individuals upon first interacting with an organization, and subsequently at [Assignment: organization-defined frequency — to be defined]; b. Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language; c. Identifies the authority that authorizes the processing of personally identifiable information; d. Identifies the purposes for which personally identifiable information is to be processed; and e. Includes [Assignment: organization-defined information — to be defined].

Procedure:

The System Owner identifies each place where the system meets the public or staff. The Privacy Officer drafts the notice from the approved privacy impact assessment and the system of records notice. The draft names the legal authority, each purpose, and the routine uses and disclosures. The Privacy Officer checks that the text uses plain words, and the SAOP approves it.

The development team places the notice on the first screen or form a person sees. The team also shows the notice again [PT-05 parameter 1 — to be defined]. The ISSO checks that the notice appears as approved before the system goes into production.

The Privacy Officer maintains the website privacy policy. When the Organization adds a web measurement tool or a third-party website or application, the Privacy Officer updates the policy. The Privacy Officer also posts a privacy notice on the third-party page where feasible. The Privacy Officer reviews web measurement tools every year, as OMB M-10-22 requires.

When the authority, a purpose, or a disclosure changes, the System Owner notifies the Privacy Officer. The Privacy Officer revises the notice, and the SAOP approves the revision before it goes live.

Evidence: each approved notice with its version date, the ISSO’s placement check, the posted website privacy policy, the yearly web measurement review, and the approval record for each revision.

PT-05(2) — Privacy Act Statements #

Baselines: Privacy

Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.

Procedure:

The System Owner lists every paper and electronic form that collects data for a system of records. The Privacy Officer drafts a Privacy Act statement for each form from the system of records notice. The SAOP approves the statement. The development team or forms manager places the statement on the form, or prints it as a separate page the person can keep. When the system of records notice changes, the Privacy Officer updates each linked statement.

Evidence: the form inventory, each approved Privacy Act statement with its date, and a copy of each form that shows the statement.

PT-06 — System of Records Notice #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

For systems that process information that will be maintained in a Privacy Act system of records: a. Draft system of records notices in accordance with OMB guidance and submit new and significantly modified system of records notices to the OMB and appropriate congressional committees for advance review; b. Publish system of records notices in the Federal Register; and c. Keep system of records notices accurate, up-to-date, and scoped in accordance with policy.

Procedure:

The System Owner reports each new or changed system that retrieves records by a person’s name or identifier to the Privacy Officer. The Privacy Officer decides whether the change needs a new notice, a revised notice, or no action. The Privacy Officer drafts the notice under OMB Circular A-108, and the General Counsel reviews it.

The SAOP approves the draft and sends it to OMB and the appropriate congressional committees. The Privacy Officer waits at least 30 days before submitting the notice to the Federal Register. After publication, the Privacy Officer adds the notice and its link to the privacy program web page.

The Privacy Officer reviews each published notice when the System Owner reports a change and during each routine use review. If a notice is no longer accurate, the Privacy Officer starts a revision through the same steps. When the Organization retires a system of records, the Privacy Officer prepares a notice of rescindment.

Evidence: each draft and published notice, the General Counsel review, the transmittal to OMB and Congress with its date, the Federal Register citation, and the privacy program web page listing.

PT-06(1) — Routine Uses #

Baselines: Privacy

Review all routine uses published in the system of records notice at [Assignment: organization-defined frequency — to be defined] to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.

Procedure:

The Privacy Officer schedules a review of each system of records notice[PT-06(1) parameter 1 — to be defined]. The Privacy Officer meets with the System Owner and Information Owner and checks each routine use against current disclosures and the original purpose. The Privacy Officer proposes removing or revising any routine use that no longer fits. The SAOP approves the changes, and the Privacy Officer starts a notice revision when needed.

Evidence: the review record for each notice, the SAOP decision, and any resulting notice revision.

PT-06(2) — Exemption Rules #

Baselines: Privacy

Review all Privacy Act exemptions claimed for the system of records at [Assignment: organization-defined frequency — to be defined] to ensure they remain appropriate and necessary in accordance with law, that they have been promulgated as regulations, and that they are accurately described in the system of records notice.

Procedure:

The Privacy Officer reviews each system of records that claims an exemption[PT-06(2) parameter 1 — to be defined]. The Privacy Officer compares the exemption in the notice with the published regulation. The Privacy Officer asks the System Owner whether the system still needs it. The General Counsel confirms the legal basis. The SAOP decides whether to keep, change, or drop each exemption. The Privacy Officer then starts any needed rulemaking or notice revision.

Evidence: the review record, the General Counsel’s opinion, the SAOP decision, and the regulation citation.

PT-07 — Specific Categories of Personally Identifiable Information #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

Apply [Assignment: organization-defined processing conditions — to be defined] for specific categories of personally identifiable information.

Procedure:

The System Owner lists each data element in the privacy threshold analysis. The Privacy Officer marks any element that falls into a special category. For each one, the Privacy Officer and System Owner draft the conditions for its use in the privacy impact assessment. These conditions cover who may access it, why, how it is protected, and how long it is kept. The SAOP approves the conditions.

The ISSO records the approved conditions in the SSPP. The ISSO also maps each condition to the security controls that put it in place. During the assessment, the assessor tests those controls. The Privacy Officer reviews the conditions during privacy continuous monitoring and when the System Owner reports a change.

If staff process a special category outside the approved conditions, the System Owner reports it to the Privacy Officer. The Privacy Officer handles the report as a possible privacy incident.

Evidence: the privacy threshold analysis, the privacy impact assessment with approved conditions, the SSPP privacy section, assessment results, and privacy incident records.

PT-07(1) — Social Security Numbers #

Baselines: Privacy

When a system processes Social Security numbers: (a) Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier; (b) Do not deny any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his or her Social Security number; and (c) Inform any individual who is asked to disclose his or her Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.

Procedure:

The System Owner flags each Social Security number field in the privacy threshold analysis and explains why the system needs it. The Privacy Officer checks whether another identifier would work. The SAOP approves or rejects each continued use. The Privacy Officer adds the required disclosure to the Privacy Act statement on each form. The Privacy Officer reviews the remaining uses when each privacy impact assessment is updated.

Evidence: the privacy threshold analysis, the SAOP decision for each use, and the approved Privacy Act statements.

PT-07(2) — First Amendment Information #

Baselines: Privacy

Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.

Procedure:

The Privacy Officer screens each privacy threshold analysis for data that describes how a person exercises First Amendment rights. If the system would collect such data, the System Owner must remove it or request an exception. The General Counsel reviews the request and confirms the legal basis in writing. The SAOP approves or denies it. Staff report any such data they find without an approved exception to the Privacy Officer, who handles it as a privacy incident.

Evidence: the privacy threshold analysis, the General Counsel’s written opinion, the SAOP decision, and privacy incident records.

PT-08 — Computer Matching Requirements #

Baselines: Privacy CSF 2.0: PR.DS (Data Security)

When a system or organization processes information for the purpose of conducting a matching program: a. Obtain approval from the Data Integrity Board to conduct the matching program; b. Develop and enter into a computer matching agreement; c. Publish a matching notice in the Federal Register; d. Independently verify the information produced by the matching program before taking adverse action against an individual, if required; and e. Provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual.

Procedure:

A program office that wants to compare records with another agency sends a proposal to the Privacy Officer. The proposal names the systems of records, the data, the purpose, and the partner. The Privacy Officer and the SAOP decide whether the comparison is a matching program and record that decision.

For a matching program, the Privacy Officer drafts the computer matching agreement with the System Owner and the partner agency. General Counsel reviews the draft. The Privacy Officer presents the final draft to the Data Integrity Board, which votes and records the vote in its minutes. After approval, the SAOP publishes the matching notice in the Federal Register.

When a match result could lead to adverse action, program staff check the result against a second source if the law or the agreement requires verification. The program office then sends the individual a written notice of the findings and how to contest them. Staff take no adverse action until the contest period set in the agreement ends. Each calendar year, the Data Integrity Board reviews every matching program, and the SAOP sends the board’s report to the agency head and OMB.

Evidence: the SAOP’s matching decision, the signed agreement, the Data Integrity Board minutes and annual report, the published Federal Register notice, verification records, and notice letters to individuals.

4.3 Privacy Compliance Steps #

The System Owner starts these steps at system intake. The Privacy Officer keeps each signed document in the governance, risk, and compliance (GRC) system with the system’s authorization records.

Step 1: Complete the privacy threshold analysis #

Find out whether the system handles PII and which documents it needs.

Step 2: Complete the privacy impact assessment #

Section 208 of the E-Government Act and OMB M-03-22 set the timing and content.

Step 3: Publish the system of records notice #

The Privacy Act and OMB Circular A-108 set the notice and review rules.

Step 4: Write the Privacy Act statement #

Tell each person why the information is collected before they give it.

Step 5: Control web measurement and third-party sites #

OMB M-10-22 sets three tiers for web measurement and customization technologies. OMB M-10-23 covers third-party websites and applications.

1. Tier 1 (single-session) and Tier 2 (multi-session without PII): the Mission/Business Owner may use them with a clear opt-out. The online privacy policy must name them.
2. Tier 3 (multi-session with PII): the Mission/Business Owner needs SAOP review, a 30-day public notice and comment period, opt-in consent, and the Chief Information Officer (CIO)’s written approval.
3. Annual review: the SAOP reviews each use of these technologies every year.
4. Third-party websites and applications: the Privacy Officer completes an adapted PIA for each one that makes PII available to the Organization. The Mission/Business Owner posts a privacy notice on the third-party site.

Evidence: the signed privacy threshold analysis, the published PIA and SORN, the approved Privacy Act statement, and the CIO approval for each Tier 3 use.

Source: E-Government Act of 2002, section 208; OMB M-03-22; Privacy Act of 1974, 5 U.S.C. 552a(e)(3), (e)(4), and (e)(11); OMB Circular A-108; OMB M-17-12; OMB M-10-22; OMB M-10-23.

5. Parameters (ODP Values) #

The following organization-defined parameters apply to controls in this family:

No organization-defined parameters apply to this control.

6. Evidence Artifacts #

Carrying out this procedure produces these records:

• Procedure execution records for PT
• Configuration documentation
• Periodic review records
• Evidence for IG FISMA metric RAM.01
• Evidence for IG FISMA metric RAM.02
• Evidence for IG FISMA metric RAM.03
• Evidence for IG FISMA metric RAM.04
• Evidence for IG FISMA metric DPP.01
• Evidence for IG FISMA metric DPP.02
• Evidence for IG FISMA metric DPP.23

7. Performance Measurement #

The SAOP measures this procedure with the indicators below, which meet IG FISMA Level 4 (Managed and Measurable). The ISSO collects the data, and the SAOP trends and reports it. When a measure moves away from its target, the SAOP starts corrective action through the plan of action and milestones (POA&M) process.

8. Training Requirements #

Before they carry out the steps in this procedure, and every year after, the people who perform them must complete:

• General security awareness training, which all personnel take under POL-AT.
• Role-based training on this procedure’s steps, tools, and evidence.
• Training on the technology platforms listed under Technology Implementation, matched to their duties.

Completion is a condition of continued access. The Agency Learning Management System (LMS) holds the completion records.

9. Governance References #

• OMB Circular A-108: Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act, December 23, 2016.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• E-Government Act of 2002 (Pub. L. 107-347), December 17, 2002.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• OMB M-03-22: OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, September 26, 2003.
• OMB M-10-22: Guidance for Online Use of Web Measurement and Customization Technologies, June 25, 2010.
• OMB M-10-23: Guidance for Agency Use of Third-Party Websites and Applications, June 25, 2010.
• OMB M-16-24: Role and Designation of Senior Agency Officials for Privacy, September 15, 2016.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• OMB M-21-04: Modernizing Access to and Consent for Disclosure of Records Subject to the Privacy Act, November 12, 2020.
• OMB M-25-32: Preventing Improper Payments and Protecting Privacy Through Do Not Pay, August 20, 2025.
• Privacy Act of 1974 (5 U.S.C. § 552a), December 31, 1974.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-63-4: Digital Identity Guidelines, July 31, 2025.