NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PL-5, Privacy Impact Assessment, is marked withdrawn in Rev 5. The catalog records that it was incorporated into RA-8, in the Risk Assessment family.
What it means in practice
The practice of assessing privacy impact is still expected. Only its home changed. If a questionnaire or older plan lists PL-5, answer from RA-8.
Evidence to collect
- Completed privacy impact assessments, one per system or processing activity.
- The trigger rule that says when an assessment is required.
- Approval records and actions taken.
Common gaps
- Assessments done once at launch and never refreshed.
- Withdrawn status used as a reason to skip the work.
How to implement it
Keep a short template. Run it at design time and on major changes. Store results with the system plan and link actions into your risk register.
Quick check
Where did PL-5 go?
Into RA-8, per the NIST catalog.
