Question 1

What evidence do auditors ask for on PM-20 Dissemination of Privacy Program Information. Maintain a central resource webpage on the organization's principal public website that serves as a central source of information about the organization's privacy program and that: Ensures that the?

Accepted Answer

The central privacy resource webpage on the organisation's principal public website, with its URL; Evidence the page carries the required privacy programme information, including policies, reports and notices; Confirmation the public can access the material without registration or barriers; Review record showing the page content is current and links resolve; Assignment of responsibility for maintaining the page.

Question 2

Can PM-20 be evidenced continuously rather than by periodic review?

Accepted Answer

This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.

Question 3

What is the most common gap auditors find on PM-20?

Accepted Answer

Page exists but links to superseded documents, so the public sees a stale privacy position

`PM-20` Dissemination of Privacy Program Information. Maintain a central resource webpage on the organization's principal public website that serves as a central source of information about the organization's privacy program and that: Ensures that the

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet