Assessing Security and Privacy Controls in Information Systems and Organizations
PT > PT-1 > Assessment Objective

PT-1 Policy and Procedures - Assessment Objective
Determine if the following are satisfied:

PT-01a.[01] a personally identifiable information processing and transparency policy is developed and documented;
PT-01a.[02] the personally identifiable information processing and transparency policy is disseminated to [Assignment: organization-defined personnel or roles];
PT-01a.[03] personally identifiable information processing and transparency procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and associated personally identifiable information processing and transparency controls are developed and documented;
PT-01a.[04] the personally identifiable information processing and transparency procedures are disseminated to [Assignment: organization-defined personnel or roles];
PT-01a.01(a)[01] the [Selection; one or more: organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses purpose;
PT-01a.01(a)[02] the [Selection; one or more: organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses scope;
PT-01a.01(a)[03] the [Selection; one or more: organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses roles;
PT-01a.01(a)[04] the [Selection; one or more: organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses responsibilities;
PT-01a.01(a)[05] the [Selection; one or more: organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses management commitment;
PT-01a.01(a)[06] the [Selection; one or more: organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses coordination among organizational entities;
PT-01a.01(a)[07] the [Selection; one or more: organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses compliance;
PT-01a.01(b) the [Selection; one or more: organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
PT-01b. the [Assignment: organization-defined official] is designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures;
PT-01c.01[01] the current personally identifiable information processing and transparency policy is reviewed and updated [Assignment: organization-defined frequency];
PT-01c.01[02] the current personally identifiable information processing and transparency policy is reviewed and updated following [Assignment: organization-defined events];
PT-01c.02[01] the current personally identifiable information processing and transparency procedures are reviewed and updated [Assignment: organization-defined frequency];
PT-01c.02[02] the current personally identifiable information processing and transparency procedures are reviewed and updated following [Assignment: organization-defined events].