Dissemination of Privacy Program Information
LOW MODERATE HIGHRequirements NIST SOURCE
Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy program and that:
Requirement Context
This element is part of PM-20 — Dissemination of Privacy Program Information. See the Assessment section below for the related SP 800-53A examine/interview/test procedures. No engineering interpretation has been authored for this control yet.
Requirement Context
This element is part of PM-20 — Dissemination of Privacy Program Information. See the Assessment section below for the related SP 800-53A examine/interview/test procedures. No engineering interpretation has been authored for this control yet.
Requirement Context
This element is part of PM-20 — Dissemination of Privacy Program Information. See the Assessment section below for the related SP 800-53A examine/interview/test procedures. No engineering interpretation has been authored for this control yet.
Discussion (NIST Supplemental Guidance)
For federal agencies, the webpage is located at www.[agency].gov/privacy. Federal agencies include public privacy impact assessments, system of records notices, computer matching notices and agreements, PRIVACT exemption and implementation rules, privacy reports, privacy policies, instructions for individuals making an access or amendment request, email addresses for questions/complaints, blogs, and periodic publications.
Enhancements NIST SOURCE
PM-20(1) Privacy Policies on Websites, Applications, and Digital Services LOW MODERATE HIGH
Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that:
- (a) Are written in plain language and organized in a way that is easy to understand and navigate;
- (b) Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and
- (c) Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes.
Discussion
Organizations post privacy policies on all external-facing websites, mobile applications, and other digital services. Organizations post a link to the relevant privacy policy on any known, major entry points to the website, application, or digital service. In addition, organizations provide a link to the privacy policy on any webpage that collects personally identifiable information. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that require the provision of specific information to the public. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for PM-20 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- a central resource webpage is maintained on the organization�s principal public website;
- the webpage serves as a central source of information about the organization�s privacy program;
- the webpage ensures that the public has access to information about organizational privacy activities;
- the webpage ensures that the public can communicate with its senior agency official for privacy;
- the webpage ensures that organizational privacy practices are publicly available;
- the webpage ensures that organizational privacy reports are publicly available;
- the webpage employs publicly facing email addresses and/or phone numbers to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.
Examine
[SELECT FROM: Public website; publicly posted privacy program documents, including policies, procedures, plans, and reports; position description of the senior agency official for privacy; public privacy notices, including Federal Register notices; privacy impact assessments; privacy risk assessments; Privacy Act statements and system of records notices; computer matching agreements and notices; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with privacy program information dissemination responsibilities; organizational personnel with privacy responsibilities].
Test
[SELECT FROM: Location, access, availability, and functionality of privacy resource webpage].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for PM-20. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- publicly posted privacy program documents, including policies, procedures, plans, and reports
Testing
- Location, access, availability, and functionality of privacy resource webpage
Other Records
- Public website
- position description of the senior agency official for privacy
- public privacy notices, including Federal Register notices
- privacy impact assessments
- privacy risk assessments
- Privacy Act statements and system of records notices
- computer matching agreements and notices
- other relevant documents or records