PM-26, Complaint Management, asks you to run a process for receiving and responding to complaints, concerns or questions from individuals about your security and privacy practices. The process needs easy and accessible mechanisms, the information needed to file a complaint, tracking so each one is reviewed and addressed within a set time, acknowledgement of receipt within a set time, and a response within a set time. The time limits are yours to define. 800-53 binds federal systems and others by contract, and it works as a reference for any company that takes outside questions.
What it means in practice
NIST says complaints are valuable input that can improve operating models, technology use, data collection practices and controls. Public mechanisms can be a hotline, email or web form. The information needed to file includes contact details for the privacy official or other designated person.
The record also notes that privacy complaints may contain PII, which must be handled under your own policies. A complaint inbox is itself a place where personal data accumulates.
The clocks are the part auditors test. You choose the acknowledgement time and the response time, then show that you met them.
Evidence to collect
- The published complaint channel and instructions
- A tracking system or log with timestamps for receipt, acknowledgement and response
- The defined time limits in policy
- Samples of closed complaints and the replies sent
- Metrics on time to acknowledge and time to respond
Common gaps
- The inbox is shared and nobody watches it
- No acknowledgement is sent
- Complaints with PII are stored in an open shared drive
- Time limits are not written down so they cannot be tested
How to implement it
- Publish one contact route and name an owner.
- Set acknowledgement and response targets and write them in policy.
- Track every complaint in a system with timestamps.
- Review the log each quarter and feed patterns back to the teams.
Quick check
Who sets the response time?
The organization. The statement leaves the acknowledgement and response periods as defined parameters.
