PM-24, Data Integrity Board, is one of the more federal specific controls in the catalog. It tells an agency to set up a board that reviews proposals to conduct or join a matching program and does an annual review of all matching programs it has joined. If you are not a federal agency, most of this will not apply to you directly.
What it means in practice
A matching program, per the record, is a computerized comparison of records from two or more automated systems of records, or a system of records and records held by a non federal agency. It pertains to federal benefit programs or federal personnel and payroll. The Privacy Act governs it.
For a company, the useful idea is a small review body that signs off before you combine personal data from different sources, and that looks back each year at what it approved.
If you do not touch federal benefit or personnel data, do not invent a board to satisfy this control. Say it is not applicable, and say why.
Evidence to collect
- Board charter and member list (federal agencies)
- Records of each matching program proposal and the decision
- The annual review of matching programs
- For a company, a record of cross dataset joins approved by a privacy or data group
Common gaps
- Matching happens in analytics or sales tooling with no review at all
- The board exists but the annual review was skipped
- Nobody can list the programs that combine data from two sources
How to implement it
- Decide first whether you are in scope. Check with counsel if you handle federal benefit or personnel data.
- If not, create a light approval step for combining personal datasets.
- Keep a yearly review list of every approved combination.
Quick check
Does a private company need a Data Integrity Board?
Not unless it takes part in a federal matching program. Otherwise it is a reference model for reviewing data joins.
