BaselineWatch
1196 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

NIST SP 800-53 (controls) 5.2.0

1196 requirements · published 2026-10-22
Changes in this version
AllACATAUCACMCPIAIRMAMPPEPLPMPSPTRASASCSISR
RefTitleText
PT-01 Policy and Procedures a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing an
PT-02 Authority to Process Personally Identifiable Information a. Determine and document the [Assignment: authority] that permits the [Assignment: processing] of personally identifiable information; and b. Restrict the [Assignment: processing] of personally identifiable information to only that which i
PT-02(01)
in PT-2
 Data Tagging Attach data tags containing [Assignment: authorized processing] to [Assignment: elements of personally identifiable information].
PT-02(02)
in PT-2
 Automation Manage enforcement of the authorized processing of personally identifiable information using [Assignment: automated mechanisms].
PT-03 Personally Identifiable Information Processing Purposes a. Identify and document the [Assignment: purpose(s)] for processing personally identifiable information; b. Describe the purpose(s) in the public privacy notices and policies of the organization; c. Restrict the [Assignment: processing] of
PT-03(01)
in PT-3
 Data Tagging Attach data tags containing the following purposes to [Assignment: elements of personally identifiable information]: [Assignment: processing purposes].
PT-03(02)
in PT-3
 Automation Track processing purposes of personally identifiable information using [Assignment: automated mechanisms].
PT-04 Consent Implement [Assignment: tools or mechanisms] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.
PT-04(01)
in PT-4
 Tailored Consent Provide [Assignment: mechanisms] to allow individuals to tailor processing permissions to selected elements of personally identifiable information.
PT-04(02)
in PT-4
 Just-in-time Consent Present [Assignment: consent mechanisms] to individuals at [Assignment: frequency] and in conjunction with [Assignment: personally identifiable information processing].
PT-04(03)
in PT-4
 Revocation Implement [Assignment: tools or mechanisms] for individuals to revoke consent to the processing of their personally identifiable information.
PT-05 Privacy Notice Provide notice to individuals about the processing of personally identifiable information that: a. Is available to individuals upon first interacting with an organization, and subsequently at [Assignment: frequency]; b. Is clear and easy-to
PT-05(01)
in PT-5
 Just-in-time Notice Present notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action, or [Assignment: frequency].
PT-05(02)
in PT-5
 Privacy Act Statements Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.
PT-06 System of Records Notice For systems that process information that will be maintained in a Privacy Act system of records: a. Draft system of records notices in accordance with OMB guidance and submit new and significantly modified system of records notices to the O
PT-06(01)
in PT-6
 Routine Uses Review all routine uses published in the system of records notice at [Assignment: frequency] to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.
PT-06(02)
in PT-6
 Exemption Rules Review all Privacy Act exemptions claimed for the system of records at [Assignment: frequency] to ensure they remain appropriate and necessary in accordance with law, that they have been promulgated as regulations, and that they are accurat
PT-07 Specific Categories of Personally Identifiable Information Apply [Assignment: processing conditions] for specific categories of personally identifiable information.
PT-07(01)
in PT-7
 Social Security Numbers When a system processes Social Security numbers: (a) Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier; (b) Do not deny any individual any right
PT-07(02)
in PT-7
 First Amendment Information Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized
PT-08 Computer Matching Requirements When a system or organization processes information for the purpose of conducting a matching program: a. Obtain approval from the Data Integrity Board to conduct the matching program; b. Develop and enter into a computer matching agreement;

21 of 1196.