PM-24 Data Integrity Board. Establish a Data Integrity Board to: Review proposals to conduct or participate in a matching program; and Conduct an annual review of all matching programs in which the agency has participated
Data Integrity Board. Establish a Data Integrity Board to: Review proposals to conduct or participate in a matching program; and Conduct an annual review of all matching programs in which the agency has participated.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Records of the Board's review of proposals to conduct or participate in a matching program · Policy repository / GRC workspace
- The annual review of all matching programs the organisation participated in, with its findings · Document repository
- Evidence of Board decisions where a proposal was rejected or conditioned · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Document establishing the Data Integrity Board, its charter and its membership · Policy repository / GRC workspace
- Computer matching agreements and notices considered by the Board · Vendor register / contract repository
First move
Common gaps auditors find
- Board reviews new proposals but skips the annual review of existing matching programs
- Matching activity conducted under an agreement that was never brought to the Board
- Board membership drawn only from the programme proposing the match, removing independence
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-23 Data Governance Body. Establish a Data Governance Body consisting of [organization-defined] with [organization-defined] · PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research. Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research; Limit or