PM-19, Privacy Program Leadership Role, is a single sentence: appoint a senior agency official for privacy with the authority, mission, accountability and resources to coordinate, develop and implement privacy requirements and manage privacy risks. NIST 800-53 binds federal systems, and other organizations through contract. For everyone else it is a reference you can borrow when a customer asks who owns privacy.
What it means in practice
NIST notes that outside federal agencies this person may be called the chief privacy officer. The title matters less than the four attributes in the statement. The person needs authority to make decisions, a mission that is written down, accountability for outcomes, and resources to do the work.
The record also says this official has roles on the data management board (PM-23) and the data integrity board (PM-24), so the role is expected to connect to data governance.
Auditors tend to test authority first. Ask what happens when the privacy lead says a launch must wait. If the honest answer is that someone else decides, the role exists in name only.
Evidence to collect
- A signed appointment letter or role description naming the privacy lead
- An org chart showing who they report to
- Budget or headcount allocated to privacy work
- Meeting notes or approvals that show them making privacy decisions
Common gaps
- The role is held by "legal" or "security" in name only, with no written appointment
- The owner has accountability but no budget or authority to stop a launch
- The name on the policy left the company a year ago
How to implement it
- Pick one person and write down the appointment, including the authority they hold.
- Give them a standing seat in security and data governance meetings.
- Record the resources they control, even if the number is small.
- Review the appointment when people change roles, and at least once a year.
Quick check
Does the privacy lead have to be a full time role?
The statement does not say so. It asks for authority, mission, accountability and resources. A small company can assign it to one person as long as those four are real and documented.
