PM-27, Privacy Reporting, asks you to develop and send privacy reports to defined oversight bodies, to show accountability with statutory, regulatory and policy privacy mandates, and to senior management and others who monitor privacy compliance. You also review and update the reports on a set schedule. The recipients and frequency are yours to define.
What it means in practice
The record says internal and external reporting promote accountability and transparency, show progress against requirements, expose gaps, and help identify models for success. Federal examples include annual reports to OMB and to Congress. A company can mirror that with a regular privacy report to its board or to a customer under contract.
NIST 800-53 binds federal systems and others by contract, so treat the federal examples as a reference and set your own recipients.
Evidence to collect
- A report template and a distribution list
- Copies of recent reports with dates
- Evidence of review and update on the defined schedule
- Metrics: requests handled, incidents, training completion
Common gaps
- Reports are written only after an incident
- No defined audience, so nobody reads them
- Metrics change every time and cannot be compared
How to implement it
- Define the recipients and cadence in the policy.
- Pick five stable metrics and track them each period.
- Store reports with their approval record.
Quick check
Who should receive the privacy report?
Whoever the organization defines as oversight, plus senior management and personnel responsible for monitoring privacy compliance.
