PM-21 Accounting of Disclosures. Develop and maintain an accurate accounting of disclosures of personally identifiable information, including: Date, nature, and purpose of each disclosure; and Name and address, or other contact information of the individual
Accounting of Disclosures. Develop and maintain an accurate accounting of disclosures of personally identifiable information, including: Date, nature, and purpose of each disclosure; and Name and address, or other contac.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- The accounting of disclosures record showing date, nature and purpose of each disclosure · Document repository
- Evidence the accounting is retained for the required period · Document repository
- Evidence the accounting can be produced to an individual on request · Document repository
governing documentDocuments that govern the control
- Name and address or other contact information of the person or organisation the information went to · Document repository
- The process by which disclosures are captured into the accounting at the time they occur · Document repository
First move
Common gaps auditors find
- Only formal written disclosures captured while routine system to system transfers are not
- Accounting reconstructed from logs at request time rather than maintained, so it is incomplete
- Purpose recorded as a generic category, which does not meet the nature and purpose requirement
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-20 Dissemination of Privacy Program Information. Maintain a central resource webpage on the organization's principal public website that serves as a central source of information about the organization's privacy program and that: Ensures that the · PM-22 Personally Identifiable Information Quality Management. Develop and document organization-wide policies and procedures for: Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; Correcting or deleting inaccurate