BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.6.7 Privacy Official (PO) (was: Role Assignment Policies)

NIST PIV and digital identity SP 800-79-2 against SP 800-79-1
All changes in this version
modified 2 PREPARATION FOR ASSESSMENT AND AUTHORIZATION part of 2.6

Title changed

Before · SP 800-79-1

Role Assignment Policies

After · SP 800-79-2

RolePrivacy AssignmentOfficial Policies(PO)

Control changed

Before · SP 800-79-1

Although PCI roles are independent and should be filled by different people if feasible, there may be a need (e.g., because of availability or economy) to have one person fill more than one role. Except for the roles of Assessor and Privacy Official, one person may perform more than one role if needed. If an organization has multiple PCIs, one person may be assigned the same role in several or all of them. For instance, a SAO may be responsible for several PCIs within the organization. Similarly, within a single PCI, a PCIF Manager may be responsible for a number of PCI Facilities. Of the roles described, the SAO, DAA, OIMO, CAR, Assessor and PO must be employees of the organization that owns the PCI (e.g., Federal employees in the case of Federal agencies).

After · SP 800-79-2

Although PCI roles are independent and should be filled byThe differentresponsibilities peopleof ifthe feasible,Privacy thereOfficial mayare bedefined ain needFIPS (e.g201-2., because of availabilityThe orperson economy)filling tothis haverole oneshall personnot fillassume moreany thanother oneoperational role. Except forwithin the roles of Assessor andissuer Privacyorganization. Official,The onePO personissues maypolicy performguidelines morewith thanrespect oneto rolecollection ifand needed.handling Ifof anpersonally organizationidentifiable hasinformation multiplefrom PCIs,applicants oneso personas mayto beensure assignedthat the sameissuer roleis in severalcompliance orwith all of them. For instance, a SAO may be responsible for severalrelevant PCIsdirectives withinof the organization. Similarly, within a singleprivacy PCI,laws. aThe PCIFPO’s Managerrole may be responsible for a number of PCIfilled Facilities.by Ofan theorganization’s rolesexisting described,official thefor SAO,privacy DAA(e.g., OIMO,a CAR,Chief AssessorPrivacy andOfficer). PO11

11 mustPrivacy beofficial employeesrefers ofto the organizationSenior thatAgency ownsOfficial thefor PCIPrivacy (e.g., Federal employees inSAOP) theor caseChief ofPrivacy FederalOfficer agencies(CPO).