Cyber · Trackr The Free Compliance Library
⌘K
PT · Plan wizard

PII Processing and Transparency Plan

Documents how the system manages PII processing authority, lawful purpose, transparency to data subjects, consent, system-of-records notices, individual rights (access / amendment), and dissemination across third parties. Covers the controls of the PT family in NIST SP 800-53 r5 and aligns with the Privacy Act of 1974 (5 U.S.C. § 552a), E-Government Act of 2002 (Section 208 — PIA), OMB M-03-22 (PIA guidance), OMB M-17-12 (breach response), NIST IR 8062 (Privacy Risk Management Framework), NIST IR 8112 (Attribute Metadata), GDPR / state privacy laws where applicable, and Fair Information Practice Principles (FIPPs).

1 System metadata
Full official name of the information system.
Short identifier used in headings and references.
Role or named individual accountable for the system.
Describe what falls inside the authorization boundary - components, services, networks, data flows.
2 Baseline
PT is a privacy-baseline family. Every PT control lives in the NIST Privacy baseline. Choose NIST Privacy below to populate this plan with in-baseline cards. Other baselines will render zero in-baseline rules — you can still mark individual enhancements Selected by hand if needed.
Determines which controls in this family appear in your plan.
3 Personally Identifiable Information Processing and Transparency approach
Approach basics → §4.x

Roles and locations that anchor the rest of the plan.

Role accountable for the privacy program (e.g., 'Senior Agency Official for Privacy (SAOP)', 'Chief Privacy Officer', 'Privacy Officer + delegate to ISSO').
Where privacy-program policy, procedures, and registers are maintained.
Where the system's Privacy Impact Assessment lives. Per E-Government Act Section 208 + OMB M-03-22.
Where applicable System of Records Notices (SORNs) are published / cited. Per Privacy Act § (e)(4).
Brief phrase describing how individuals exercise rights of access / amendment / complaint (e.g., 'Privacy Act request portal at agency.gov/privacy', 'Mailbox privacy@agency.gov triaged by Privacy Office').
Role accountable for third-party agreements involving PII (e.g., 'Privacy Officer with General Counsel concurrence').
Where MOUs / DSAs / Computer Matching Agreements / Routine Use authorizations are registered.
Authority and Purpose (PT-2) → §4.x

Legal authority and lawful purpose for PII processing.

Statute / regulation / executive order authorizing PII processing (e.g., '5 U.S.C. § 301 housekeeping authority + agency-specific statute X'). Reference Privacy Act § (e)(3)(A).
    Suggested:
    Per PT-2(1) — how the system enforces use only for authorized purposes. Access-control mapping, query restrictions, masking for non-authorized roles.
    Per PT-2(2) — basis on which PII is disclosed externally (statute, routine use under SORN, individual consent, court order).
    Data Minimization and Consent (PT-3, PT-4) → §4.x

    Data-element minimization and individual consent.

    Where the data-element-level inventory of PII processed by the system lives. Reference RA-8.
    Per PT-4(1) — how individuals revoke consent and consequences (some processing may continue under independent legal authority; some must stop).
    Per PT-4(2) — how consent records are managed (timestamp, method, scope, retention).
    Privacy Notice (PT-5) → §4.x

    Notice provided to data subjects.

    How often the privacy notice is reviewed for currency. PT-5 ODV. Common: 'Annually + on substantive change to processing'.
    Per PT-5(1) — when JIT notices are presented (e.g., when collecting data for a new purpose, when broadening dissemination).
    Per PT-5(2) and Privacy Act § (e)(3) — Privacy Act statement provided when collecting from individuals.
    System of Records Notices (PT-6) → §4.x

    Privacy Act SORN compliance.

    If SORN required: when last published in Federal Register, citation, current applicability.
    List of routine uses authorized in the SORN. Reference Privacy Act § (a)(7).
    Per PT-6(1) — where routine-use inventory is maintained for SORN currency.
    Per PT-6(2) — practices for maintaining records of disclosures and accountings.
    If multiple SORNs apply, where the inventory is tracked.
    Specific Categories of PII (PT-7) → §4.x

    Special handling for sensitive PII categories.

    Special protections applied to sensitive categories (encryption, restricted access, additional consent, additional notice, statutory floor).
    Per PT-7(1) — when SSN use is required vs alternatives (employee ID, tax ID, internal identifiers). Reference OMB M-07-16 SSN reduction.
    Per PT-7(2) — handling of First-Amendment-protected information (political beliefs, religion, association). Generally collected only when expressly authorized.
    Computer Matching Requirements (PT-8) → §4.x

    Computer-matching agreement governance.

    Where Computer Matching Agreements are registered (if applicable).
    Federal-agency DIB role if matching applies.
    How individuals are notified of adverse match results before agency action (per Privacy Act § (p)(3)).
    Individual Rights of Access and Amendment → §4.x

    Privacy Act / regulatory rights administration.

    Time-to-respond per Privacy Act § (d) and agency policy. Common: 'Acknowledgment within 10 business days; substantive response within 30 days'.
    How requester identity is verified before disclosure. Privacy Act § (e)(1) prohibits release without verification.
    How long rights-request records are retained per NARA / Privacy Act § (c).
    Privacy Scope and Coverage → §2.x

    Quantitative scope numbers that anchor metrics later in the plan.

    Order-of-magnitude count of individuals whose PII is processed (anchors breach-impact analysis).
    Approximate count of distinct PII data elements collected.
    Count of external organizations receiving PII through SORN routine uses or other agreements.
    Approximate volume of individual-rights requests per quarter.
    Privacy Metrics & KPIs → §6.x

    Metrics tracked to demonstrate PT control effectiveness.

      Suggested:
      Privacy Incident Handling → §6.x

      Coordination with the IR plan for privacy incidents.

      Notification obligations per OMB M-17-12 (federal), state breach laws, GDPR if applicable. Timing, recipients, content.
      How the privacy program coordinates with IR — typically privacy officer joins incident-handling team for PII-involving incidents.
      Cross-references to other RMF artifacts → §7

      Where this plan plugs into the broader RMF package.

      Where in the SSP the PT control implementations are summarized (e.g., 'SSP §13.17').
      Convention for PT-related POA&M items (e.g., 'POAM-PT-' for general).
      How RA-8 PIA is the entry point. PIA initiation triggers PT plan review; PT implementation feeds PIA conclusions.
      How PT-2 / PT-3 processing limits are enforced through AC-2 / AC-3 / AC-6 access-control mechanisms.
      How privacy-related awareness and role-based training (PT-3) is delivered through AT-2 / AT-3.
      How PT-4 / PT-5 records overlap with the audit pipeline. Privacy Act accountings (§ (c)) recorded in audit.
      How PT-3(2) data minimization aligns with SI-12(1) PII limitation and SI-12(2) test-data minimization.
      How privacy incidents trigger the IR plan workflow under OMB M-17-12 breach-notification timelines.
      Pointer to the CA-7 monitoring strategy document tying PT continuous-monitoring metrics to the broader ConMon plan.
      4 Per-control implementation

      Pick a baseline in section 2 and the applicable controls will appear here. Each control gets a card with the official text, related controls, linked CCIs, and fields for your implementation status, narrative, responsible role, and evidence.

      5 Document metadata

      Your answers autosave to this browser. Click Save progress to download a JSON file you can re-upload later or share.