NIST 800-53 PM-18 Privacy Program Plan: What It Contains

PM-18, Privacy Program Plan, asks you to develop and share an organization wide plan that gives an overview of the privacy program. The statement says agency, because 800-53 is written for federal systems and reaches others by contract. For a company, it works well as an outline for the privacy document a customer or auditor may ask to see.

What it means in practice

The statement lists what the plan must cover:

• The structure of the privacy program and the resources dedicated to it
• The requirements for the program and the management and common controls in place or planned
• The role of the senior official for privacy and the roles of other privacy staff
• Management commitment, compliance and strategic goals
• Coordination among the groups responsible for different aspects of privacy
• Approval by a senior official who is accountable for managing privacy risk

The record says a plan can be one document or a compilation. It also says the senior official designates which privacy controls are common controls, meaning controls inherited by many systems.

The plan is also reviewed and updated on a defined schedule, so a stale plan is a finding.

Evidence to collect

• The privacy program plan with approval signature and date
• Org chart or role list for privacy staff
• List of common privacy controls and who owns them
• Evidence the plan was shared with relevant staff
• Review history

Common gaps

• Plan is a copy of a template with no local detail
• No signature from a senior official
• Roles listed are people who have left
• Plan describes controls that are not in place and does not mark them as planned

How to implement it

• Start from the six items above and write one section for each.
• Mark every control as in place or planned, with dates for planned ones.
• Get approval from a senior official and record it.
• Share the plan with the people named in it.
• Put the annual review on the calendar.

Quick check

Sources

• NIST SP 800-53 Rev 5, PM-18 Privacy Program Plan
• NIST OSCAL catalog for SP 800-53 Rev 5