Privacy: Dedicated Leadership Can Improve Programs and Address Challenges
GAO-22-105065
Published: Sep 22, 2022. Publicly Released: Sep 22, 2022.
Federal agencies that collect personally identifiable information—such as birthplaces and Social Security numbers—are required to establish programs to protect it.
The 24 agencies we examined had designated a senior agency official for privacy, as required. However, these officials may have numerous other duties and may not bring a needed focus on privacy. They generally delegated many aspects of privacy programs to less-senior officials.
We recommended that Congress consider legislation to designate dedicated, senior-level privacy officials. We also made more than 60 other recommendations to strengthen agency privacy programs.
What GAO Found
The 24 Chief Financial Officer (CFO) Act of 1990 agencies varied in the extent to which they addressed key practices for implementing privacy programs:
- Agencies generally established policies and procedures for key privacy activities. These included developing system of records notices, to identify personal data collected and how they are used; conducting privacy impact assessments; and documenting privacy program plans.
- Agencies varied in establishing policies and procedures for coordination between privacy programs and other agency activities, such as information security, budget and acquisition, workforce planning, and incident response.
- Many agencies did not fully incorporate privacy into their risk management strategies, provide for privacy officials' input into the authorization of systems containing personally identifiable information (PII), and develop a privacy continuous monitoring strategy.
Extent to Which 24 Chief Financial Officers Act of 1990 Agencies Addressed Key Practices for Establishing a Privacy Program
Without fully establishing these elements of their privacy programs, agencies have less assurance that they are consistently implementing privacy protections.
Agencies most frequently cited the following challenges in implementing their privacy programs (see table). Additional information sharing could help agencies address selected challenges.
24 Chief Financial Officer Act of 1990 Agency Challenges in Implementing Privacy Programs
|
Challenge |
Number of agencies reporting challenge |
|
Having sufficient resources |
21 |
|
Applying privacy requirements to new technologies |
20 |
|
Hiring privacy personnel |
17 |
|
Integrating privacy and security controls |
16 |
|
Coordinating with other agency offices and programs |
15 |
|
Ensuring agency programs are implementing privacy requirements |
15 |
|
Retaining privacy personnel |
15 |
|
Training privacy professionals |
14 |
Source: GAO analysis of agency data. | GAO-22-105065
Agencies and privacy experts identified benefits of privacy impact assessments, including providing public information and managing risks. However, they also identified factors that can limit the assessments' effectiveness. These include agencies not always initiating privacy impact assessments early enough to affect program decisions; privacy programs not aware of all agency systems with PII; and privacy programs unable to hold agency staff accountable for developing privacy impact assessments.
Addressing key privacy program practices, program challenges, and privacy impact assessment effectiveness requires significant leadership commitment at agencies. In accordance with Office of Management and Budget (OMB) guidance, the 24 agencies have each designated a senior agency official for privacy. However, most of these officials do not have privacy as their primary responsibility and have numerous other duties relating to, for example, managing IT and information security. Officials with primary duties other than privacy are unlikely to spend a majority of their time focused on privacy, and agencies generally delegated operational aspects of their privacy programs to less-senior officials. This makes it less likely that the senior agency officials for privacy will focus their attention on privacy in discussions with other senior agency leaders.
The shortcomings in agency policies and challenges they reported could be better addressed by a senior-level official with privacy as a primary area of responsibility. In particular, such an official could be better positioned to ensure a consistent focus on privacy at the level of senior leadership, facilitate cross-agency coordination, and elevate the importance of privacy. OMB privacy staff stated that they believed codifying a dedicated senior privacy official in statute would strengthen agency programs and better enable them to address challenges. In addition, several agency officials and privacy experts noted that a senior agency leader dedicated to privacy could better ensure cross-agency coordination and elevate the importance of privacy. Establishing such a position in law could enhance the leadership commitment needed to give attention to privacy issues across the government.
Why GAO Did This Study
The protection of personal privacy has become a more significant issue in recent years with the advent of new technologies and the proliferation of personal information. Federal agencies collect and process large amounts of PII for various government programs. Accordingly, they must ensure that any PII they collect, store, or process is protected from unauthorized access, tampering, or loss.
Federal agencies are required to establish privacy programs for the protection of PII that they collect and process. Among other things, this includes designating a senior agency official for privacy with overall responsibility for the agency's privacy program. In addition, agencies are to conduct privacy impact assessments to analyze how personal information is collected, stored, shared, and managed in a federal system.
GAO was asked to review federal agencies' privacy programs. This report examines (1) the extent to which agencies have established programs for ensuring privacy protections; (2) challenges agencies reported experiencing in implementing their privacy programs; (3) reported benefits and limitations in agencies' use of privacy impact assessments; and (4) the extent to which agencies have senior leadership dedicated to privacy issues.
To do so, GAO compared policies and procedures at the 24 CFO Act agencies to key practices for establishing privacy programs. These practices included privacy compliance activities, coordination between privacy and other agency programs or functions, and activities to manage privacy risks.
In addition, GAO surveyed the 24 agencies on benefits and limitations of privacy impact assessments, and on challenges in implementing their privacy programs. GAO also interviewed privacy experts, relevant agency officials, and staff at OMB's privacy branch.
Recommendations
GAO is recommending one matter for congressional consideration, that Congress consider legislation to designate a dedicated, senior-level privacy official at agencies that currently lack one. GAO is also making two recommendations to OMB to facilitate information sharing to help agencies address selected challenges and better implement privacy impact assessments.
Finally, GAO is making 62 recommendations to selected agencies to fully implement key practices for their privacy programs. This includes fully establishing policies and procedures for coordination between privacy programs and other agency functions and incorporating privacy into risk management activities.
Twenty agencies, including OMB, agreed with the recommendations, and several described planned actions to implement them. One agency did not explicitly state whether it agreed with the recommendations, but generally agreed with the report. One agency disagreed with the recommendations, while another disagreed with some recommendations and partially agreed with others. Two agencies stated that they had no comments on the report. GAO continues to believe all of its recommendations are warranted.
Matter for Congressional Consideration
| Matter | Status | Comments |
|---|---|---|
| Congress should consider legislation to designate a senior privacy official, such as a chief privacy officer, at agencies that currently lack such a position. This position should have privacy as its primary duty, the organizational placement necessary to coordinate with other agency functions and senior leaders, and the authority to ensure that privacy requirements are implemented and privacy concerns are elevated to the head of the agency. | As of February 2023, no new legislation designating a senior privacy official at agencies that currently lack such a position has been enacted. |
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Office of Management and Budget | The Director of OMB should take steps to promote, through the Federal Privacy Council or other channels, sharing of information and best practices to help agencies address challenges identified in this report, including the application of privacy requirements and risk management to new and emerging technologies and integrating security and privacy controls. (Recommendation 1) |
OMB's Office of Information and Regulatory Affairs stated it agreed with our recommendation and would take steps to address it. As of February 2023, OMB had not provided further updates on actions taken to address this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Office of Management and Budget | The Director of OMB should take steps to promote, through the Federal Privacy Council or other channels, the sharing of information, best practices, and other resources related to conducting privacy impact assessments. (Recommendation 2) |
OMB's Office of Information and Regulatory Affairs stated it agreed with our recommendation and would take steps to address it. As of February 2023, OMB had not provided further updates on actions taken to address this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Agriculture | The Secretary of Agriculture should document program management controls and common privacy controls in place or planned for meeting applicable requirements and managing risks. (Recommendation 3) |
The Department of Agriculture stated that it generally agreed with the findings and recommendations in our report. As of February 2023, the department stated that it is documenting these controls in its privacy program plan and in its cybersecurity assessment and management system. Officials estimated that these efforts would be completed by the end of June 2023. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Agriculture | The Secretary of Agriculture should fully define and document a process for ensuring that the senior agency official for privacy, or other designated privacy official, reviews IT capital investment plans and budgetary requests. (Recommendation 4) |
The Department of Agriculture stated that it generally agreed with the findings and recommendations in our report. As of February 2023, the department stated that it will define and document a process for reviewing IT capital investment plans and budgetary requests, to include approval by the senior agency official for privacy. The department estimated that it would complete these efforts by the end of June 2023. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Agriculture | The Secretary of Agriculture should fully define and document a process for ensuring that the senior agency official for privacy or other designated privacy official is involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy. (Recommendation 5) |
The Department of Agriculture stated that it generally agreed with the findings and recommendations in our report. As of February 2023, the department stated that it will update its departmental privacy policies to include a detailed process on how the senior agency official for privacy or other designated privacy officials assess and address the hiring, training, and professional development. The department estimated that it would complete these efforts by the end of June 2023. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Agriculture | The Secretary of Agriculture should establish a time frame for incorporating privacy into an organization-wide risk management strategy that includes a determination of risk tolerance, and develop and document this strategy. (Recommendation 6) |
The Department of Agriculture stated that it generally agreed with the findings and recommendations in our report. As of February 2023, the department stated that its Office of Budget and Program Analysis will incorporate privacy and a process for developing risk tolerance into the USDA Enterprise Risk Management strategy through departmental guidance. It estimated completing these efforts by the end of December 2023. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Agriculture | The Secretary of Agriculture should fully define and document the role of the senior agency official for privacy or other designated privacy official in reviewing and approving system categorizations, overseeing privacy control assessments, and reviewing authorization packages, and document these roles. (Recommendation 7) |
The Department of Agriculture stated that it generally agreed with the findings and recommendations in our report. As of February 2023, the department stated that the Privacy Office will document and update its privacy policies and procedures to include a detailed process for the senior agency official for privacy or other designated privacy officials to review and approve system categorizations and oversee privacy control assessments. Officials estimated that they would complete this effort by the end of June 2023. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Agriculture | The Secretary of Agriculture should establish a time frame for fully developing a privacy continuous monitoring strategy, and develop and document this strategy. (Recommendation 8) |
The Department of Agriculture stated that it generally agreed with the findings and recommendations in our report. As of February 2023, the department stated that it is updating its continuous monitoring strategy and estimated completing these efforts by June 30, 2023. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Commerce | The Secretary of Commerce should ensure that its organization-wide risk management strategy includes key elements, including a determination of privacy risk tolerance. (Recommendation 9) |
The Department of Commerce agreed with our recommendation and stated that it planned to develop a formal action plan. As of February 2023, Commerce had not provided additional updates on any further actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Defense | The Secretary of Defense should establish a time frame for fully defining a process to ensure that the senior agency official for privacy or other designated senior privacy official is involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy, and document this process. (Recommendation 10) |
The Department of Defense concurred with our recommendation and stated that it would take steps to address it by the end of April 2024. Once the department states that it has taken action, we plan to verify if implementation has occurred.
|
| Department of Defense | The Secretary of Defense should establish a time frame for incorporating privacy into an organization-wide risk management strategy that includes a determination of risk tolerance, and develop and document this strategy. (Recommendation 11) |
The Department of Defense concurred with our recommendation and stated that it would take steps to address it by the end of April 2024. Once the department states that it has taken action, we plan to verify if implementation has occurred.
|
| Department of Defense | The Secretary of Defense should establish a time frame for fully developing a privacy continuous monitoring strategy, and develop and document this strategy. (Recommendation 12) |
The Department of Defense concurred with our recommendation and stated that it would take steps to address it by the end of April 2024. Once the department states that it has taken action, we plan to verify if implementation has occurred.
|
| Department of Education | The Secretary of Education should establish a time frame for updating the department's policies for creating, reviewing, and publishing system of records notices, and make these updates. (Recommendation 13) |
The Department of Education concurred with our recommendation and described plans under way to address it. As of February 2023, the department had not provided additional updates on further actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Energy | The Secretary of Energy should establish a time frame for fully defining a process for ensuring that the senior agency official for privacy or other designated privacy official is involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy, and document this process. (Recommendation 14) |
The Department of Energy concurred with our recommendation and described planned actions to implement it. As of February 2023, the department stated that it will update its policies to clarify the roles of the senior agency official for privacy and other privacy officials in addressing hiring, training and professional development. The department estimated that it would complete these efforts by the end of June 2023. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Energy | The Secretary of Energy should incorporate privacy into an organization-wide risk management strategy that includes a determination of risk tolerance. (Recommendation 15) |
The Department of Energy concurred with our recommendation and described planned actions to implement it. As of February 2023, the department stated that it will work to incorporate privacy into the department-wide risk process and estimated completing these efforts by the end of October 2023. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Energy | The Secretary of Energy should establish a time frame for fully defining the role of the senior agency official for privacy or other designated privacy official in reviewing and approving system categorizations, overseeing privacy control assessments, and reviewing authorization packages, and document these roles. (Recommendation 16) |
The Department of Energy concurred with our recommendation and described planned actions to implement it. As of February 2023, the department stated that its Office of the Chief Information Officer is in the process of updating the department's privacy program order, which will include documenting and defining the role of the SAOP in reviewing and approving system categorizations, overseeing privacy control assessments, and reviewing authorization packages. The program will also review whether additional delegations are needed to empower the SAOP to perform the relevant functions. DOE estimated completing this effort by the end of June 2023. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Health and Human Services | The Secretary of Health and Human Services should fully define and document a process for ensuring that the senior agency official for privacy or other designated privacy official is involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy. (Recommendation 17) |
The Department of Health and Human Services concurred with our recommendation and described actions planned to address it. As of February 2023, the department had not provided updates on any further efforts taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Homeland Security | The Secretary of Homeland Security should incorporate privacy into an organization-wide risk management strategy that includes a determination of risk tolerance. (Recommendation 18) |
The Department of Homeland Security concurred with our recommendation and described plans to implement it. As of February 2023, the department had not provided any updates of further actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Homeland Security | The Secretary of Homeland Security should fully define and document the role of the senior agency official for privacy or other designated privacy official in reviewing and approving system categorizations, overseeing privacy control assessments, and reviewing authorization packages. (Recommendation 19) |
The Department of Homeland Security concurred with our recommendation and described plans to implement it. As of February 2023, the department had not provided any updates of further actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Homeland Security | The Secretary of Homeland Security should fully develop and document a privacy continuous monitoring strategy. (Recommendation 20) |
The Department of Homeland Security concurred with our recommendation and described plans to implement it. As of February 2023, the department had not provided any updates of further actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Housing and Urban Development | The Secretary of Housing and Urban Development should fully define and document a process for ensuring that the senior agency official for privacy, or other designated privacy official, reviews IT capital investment plans and budgetary requests. (Recommendation 21) |
The Department of Housing and Urban Development did not concur with this recommendation, stating that the HUD privacy office participates in the Office of the Chief Information Officer's Configuration Change Management Board and Technical Review Subcommittee. However, based on documentation provided by HUD, it was not clear that this role involved reviewing IT capital investment plans and budgetary requests. We intend to follow up with the department, and once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Housing and Urban Development | The Secretary of Housing and Urban Development should incorporate privacy into an organization-wide risk management strategy that includes a determination of risk tolerance. (Recommendation 22) |
The Department of Housing and Urban Development did not concur with this recommendation, stating that privacy risks at the enterprise level are addressed through the department's Risk Management Council. However, while a dedicated risk management council can be an important tool for managing agency risks, it does not replace the need for a documented risk management strategy in which the agency explicitly frames its approach to privacy risk. We intend to follow up with HUD, and once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Housing and Urban Development | The Secretary of Housing and Urban Development should establish a time frame for fully developing a privacy continuous monitoring strategy, and develop and document this strategy. (Recommendation 23) |
The Department of Housing and Urban Development did not concur with this recommendation, stating that it had established a continuous monitoring strategy. However, while the documentation provided by HUD assigns responsibilities for implementing and maintaining privacy controls, it does not establish the frequency at which these controls are to be assessed. We intend to follow up wiht HUD, and once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of the Interior | The Secretary of the Interior should establish a time frame for incorporating privacy into an organization-wide risk management strategy that includes a determination of risk tolerance, and develop and document this strategy. (Recommendation 24) |
The Department of the Interior concurred with our recommendation. As of February 2023, the department had not provided further updates on actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Justice | The Attorney General should incorporate privacy into an organizationwide risk management strategy that includes a determination of risk tolerance. (Recommendation 25) |
The Department of Justice did not concur with this recommendation, stating that its existing strategy documents address how it manages privacy risk, including a determination of risk tolerance. However, documentation provided by DOJ did not explicitly discuss the department's approach to determining privacy risk tolerance, including, for example, factors to be considered and acceptable amounts of risk. Accordingly, we continue to believe our recommendation is warranted. As of February 2023, the department had not provided further updates on actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Justice | The Attorney General should establish a time frame and fully develop and document a privacy continuous monitoring strategy. (Recommendation 26) |
The Department of Justice did not concur with this recommendation, stating that DOJ components must assess all security and privacy controls employed by an information system during initial authorization and assess a subset of controls during continuous monitoring on an ongoing basis. However, documentation provided by DOJ did not specify the frequency with which the department plans to assess each privacy control at the various risk management tiers. Accordingly, we continue to believe our recommendation is warranted. As of February 2023, the department had not provided further updates on actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Labor | The Secretary of Labor should fully define and document a process for ensuring that the senior agency official for privacy, or other designated privacy official, reviews IT capital investment plans and budgetary requests. (Recommendation 27) |
The Department of Labor stated that it concurred with our recommendation and would take steps to address it. As of February 2023, the department had not provided further updates on actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Labor | The Secretary of Labor should fully define and document a process for ensuring that the senior agency official for privacy or other designated privacy official is involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy. (Recommendation 28) |
The Department of Labor stated that it concurred with our recommendation and would take steps to address it. As of February 2023, the department had not provided further updates on actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Labor | The Secretary of Labor should fully define and document the role of the senior agency official for privacy or other designated privacy official in reviewing and approving system categorizations, overseeing privacy control assessments, and reviewing authorization packages. (Recommendation 29) |
The Department of Labor stated that it concurred with our recommendation and would take steps to address it. As of February 2023, the department had not provided further updates on actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of State | The Secretary of State should establish a time frame for incorporating privacy into an organization-wide risk management strategy that includes a determination of risk tolerance, and develop and document this strategy. (Recommendation 30) |
The Department of State concurred with our recommendation and described plans under way to address it. As of February 2023, the department stated it planned to establish a time frame for incorporating privacy into an organization-wide risk management strategy that includes a determination of risk tolerance by April 30, 2024. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of State | The Secretary of State should establish a time frames for fully defining and the role of the senior agency official for privacy or other designated privacy official in reviewing and approving system categorizations, overseeing privacy control assessments, and reviewing authorization packages, and document these roles. (Recommendation 31) |
The Department of State concurred with our recommendation and described plans under way to address it. As of February 2023, the department stated that it planned to fully define and document these roles by April 30, 2024. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of State | The Secretary of State should establish a time frame for fully developing a privacy continuous monitoring strategy, and develop and document this strategy. (Recommendation 32) |
The Department of State concurred with our recommendation and described plans under way to address it. As of February 2023, the department stated that it planned to fully develop and document a privacy continuous monitoring strategy by April 30, 2024. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Transportation | The Secretary of Transportation should fully define and document a process for ensuring that the senior agency official for privacy or other designated privacy official is involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy. (Recommendation 33) |
The Department of Transportation concurred with our recommendation. As of February 2023, the department had not provided further updates on actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Transportation | The Secretary of Transportation should incorporate privacy into an organization-wide risk management strategy that includes a determination of risk tolerance. (Recommendation 34) |
The Department of Transportation concurred with our recommendation. As of February 2023, the department had not provided further updates on actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of the Treasury | The Secretary of the Treasury should fully define and document a process for ensuring that the senior agency official for privacy, or other designated privacy official, reviews IT capital investment plans and budgetary requests. (Recommendation 35) |
The Department of the Treasury did not state whether it concurred with our recommendation. As of February 2023, the department had not provided further updates on actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of the Treasury | The Secretary of the Treasury should fully define and document a process for ensuring that the senior agency official for privacy or other designated privacy official is involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy. (Recommendation 36) |
The Department of the Treasury did not state whether it concurred with our recommendation. As of February 2023, the department had not provided further updates on actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of the Treasury | The Secretary of the Treasury should incorporate privacy into an organization-wide risk management strategy that includes a determination of risk tolerance. (Recommendation 37) |
The Department of the Treasury did not state whether it concurred with our recommendation. As of February 2023, the department had not provided further updates on actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of the Treasury | The Secretary of the Treasury should establish a time frame for fully defining the role of the senior agency official for privacy or other designated privacy official in reviewing and approving system categorizations, overseeing privacy control assessments, and reviewing authorization packages, and document these roles. (Recommendation 38) |
The Department of the Treasury did not state whether it concurred with our recommendation. As of February 2023, the department had not provided further updates on actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of the Treasury | The Secretary of the Treasury should fully develop and document a privacy continuous monitoring strategy. (Recommendation 39) |
The Department of the Treasury did not state whether it concurred with our recommendation. As of February 2023, the department had not provided further updates on actions taken to address this recommendation. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should establish a time frame for defining a process for ensuring that the senior agency official for privacy, or other designated privacy official, reviews IT capital investment plans and budgetary requests, and document this process. (Recommendation 40) |
The Department of Veterans Affairs concurred with this recommendation. As of February 2023, the department stated that it planned to complete actions to address this recommendation by the end of March 2023. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should fully define and document a process for ensuring that the senior agency official for privacy or other designated privacy official is involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy. (Recommendation 41) |
The Department of Veterans Affairs concurred with this recommendation. As of February 2023, the department stated that it planned to complete actions to address this recommendation by the end of September 2023. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should fully define and document the role of the senior agency official for privacy or other designated privacy official in reviewing and approving system categorizations, overseeing privacy control assessments, and reviewing authorization packages, and document these roles. (Recommendation 42) |
The Department of Veterans Affairs concurred with this recommendation. As of February 2023, VA stated that it was updating its relevant policies to address this recommendation and anticipates completion by September 30, 2023. Once the department states that it has taken action, we plan to verify whether implementation has occurred.
|
| Department of Veterans Affairs | The Secretary of Veterans Affairs should ensure that its privacy continuous monitoring strategy includes a catalog of privacy controls and defines the frequency at which they are to be assessed. (Recommendation 43) |
In October 2022, we verified that VA, in response to our recommendation, updated its Privacy Continuous Monitoring Strategy and Privacy Controls Catalog, which outline the department's approach to managing the VA privacy continuous monitoring program, including available privacy controls and the frequency at which they are to be addressed. By taking these steps, VA should have improved awareness of the state of its privacy controls, which is necessary to support decisions for adequately protecting personally identifiable information. Accordingly, we consider this recommendation to be implemented.
|
| Environmental Protection Agency | The Administrator of EPA should fully develop and document a privacy continuous monitoring strategy. (Recommendation 44) |
The Environmental Protection Agency concurred with our recommendation and described planned actions to address it. As of February 2023, the agency had not provided updates on further actions taken to address this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| General Services Administration | The Administrator of GSA should fully define and document a process for ensuring that the senior agency official for privacy, or other designated privacy official, reviews IT capital investment plans and budgetary requests. (Recommendation 45) |
The General Services Administration stated that it agreed with our recommendation and was developing plans to address it. GSA agreed with this recommendation and in December 2022 provided evidence showing that it had established such a process. Specifically, GSA's IT Capital Planning and Investment Control process requires, among other things, the Senior Agency Official for Privacy to review and approval of budget submissions. Accordingly, we consider this recommendation to be implemented. By defining and documenting this process, GSA is better positioned to ensure privacy requirements and associated controls are explicitly identified and included with respect to any IT resources that will involve personally identifiable information.
|
| General Services Administration | The Administrator of GSA should establish a time frame for fully defining a process for ensuring that the senior agency official for privacy or other designated privacy official is involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy, and document that process. (Recommendation 46) |
The General Services Administration stated that it agreed with our recommendation and was developing plans to address it. As of February 2023, GSA had provided documents related to capacity assessment for evidence building and evaluation, but it was not clear how these related to workforce assessment. We are following up with GSA to collect additional information in order to determine whether implementation has occurred.
|
| General Services Administration | The Administrator of GSA should fully define and document the role of the senior agency official for privacy or other designated privacy official in reviewing and approving system categorizations, overseeing privacy control assessments, and reviewing authorization packages. (Recommendation 47) |
The General Services Administration stated that it agreed with our recommendation and was developing plans to address it. As of February 2023, GSA provided updated privacy policies; however, they did not include detailed procedures for how the senior agency official for privacy or other officials are to be involved in the authorization process. We are following up with GSA to collect additional information and verify whether implementation has occurred.
|
| National Aeronautics and Space Administration | The Administrator of NASA should incorporate privacy into an organization-wide risk management strategy that includes a determination of risk tolerance. (Recommendation 48) |
NASA stated that it agreed with our recommendation and was developing plans to address it. As of February 2023, NASA had provided documentation of efforts taken to address this recommendation. We are following up with NASA to collect additional information and verify whether implementation has occurred.
|
| National Aeronautics and Space Administration | The Administrator of NASA should fully define and document the role of the senior agency official for privacy or other designated privacy official in reviewing and approving system categorizations, overseeing privacy control assessments, and reviewing authorization packages. (Recommendation 49) |
NASA stated that it agreed with our recommendation and was developing plans to address it. As of February 2023, NASA had provided evidence to demonstrate actions taken to implement this recommendation. We are following up with NASA to collect additional information and verify whether implementation has occurred.
|
| Nuclear Regulatory Commission | The Chairman of NRC should fully define and document a process for ensuring that the senior agency official for privacy or other designated privacy official is involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy. (Recommendation 50) |
The Nuclear Regulatory Commission stated that it agreed with our recommendation and was developing plans to address it. As of February 2023, NRC stated that it had taken action to address this recommendation, and we plan to verify whether implementation has occurred.
|
| Nuclear Regulatory Commission | The Chairman of NRC should fully define and document the role of the senior agency official for privacy or other designated privacy official in reviewing and approving system categorizations, overseeing privacy control assessments, and reviewing authorization packages. (Recommendation 51) |
The Nuclear Regulatory Commission stated that it agreed with our recommendation and was developing plans to address it. As of February 2023, NRC stated that it had taken action to address this recommendation, and we plan to verify whether implementation has occurred.
|
| Office of Personnel Management | The Director of OPM should establish a time frame for updating the agency's policy for creating, reviewing, and publishing system of records notices, and make these updates. (Recommendation 52) |
The Office of Personnel Management partially concurred with this recommendation, noting that it has a process for system of records notices (SORN) while adding it plans to review and update any outdated SORN guidance. As of February 2023, OPM had not provided any updates on further actions taken to address this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Office of Personnel Management | The Director of OPM should define and document procedures for coordination between privacy and information security functions. (Recommendation 53) |
The Office of Personnel Management partially concurred with this recommendation, noting that it has processes in place for such coordination, while stating that it will evaluate the need for increased documentation of coordination between its privacy and security functions. As of February 2023, OPM had not provided any updates on further actions taken to address this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Office of Personnel Management | The Director of OPM should fully define and document a policy and process for ensuring that the senior agency official for privacy or other designated privacy official is involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy. (Recommendation 54) |
The Office of Personnel Management did not concur with this recommendation, noting that it has processes in place for the senior agency official for privacy's involvement in workforce planning. In particular, the agency described steps it has taken in this area, including developing a memo in 2020 outlining strategic workforce needs for the Office of Privacy and Information Management. However, OPM has not formalized the role of the SAOP in addressing hiring, training, and professional development needs with respect to privacy, helping to insure the privacy program's ability to advocate for the skilled and qualified staff it needs on an ongoing basis. Accordingly, we believe our recommendation continues to be warranted. As of February 2023, OPM had not provided any updates on further actions taken to address this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Office of Personnel Management | The Director of OPM should incorporate privacy into an organizationwide risk management strategy that includes a determination of risk tolerance. (Recommendation 55) |
The Office of Personnel Management did not concur with this recommendation, stating that its senior agency official for privacy is a member of the OPM Risk Management Council, which identifies, evaluates, and works to mitigate enterprise-wide risk. However, the agency did not develop a documented risk management strategy in which the agency explicitly frames its approach to privacy risk. Accordingly, we continue to believe our recommendation is warranted. As of February 2023, OPM had not provided any updates on further actions taken to address this recommendation. When the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Office of Personnel Management | The Director of OPM should establish a time frame for fully defining the role of the senior agency official for privacy or other designated privacy official in reviewing and approving system categorizations, overseeing privacy control assessments, and reviewing authorization packages, and document these roles. (Recommendation 56) |
The Office of Personnel Management partially concurred with this recommendation, stating that its privacy team is involved in various activities related to this process and its privacy and security teams are currently examining roles and responsibilities with respect to the controls and their selection and evaluation. As of February 2023, OPM stated that, in fiscal years 23 and 24, the agency will look for opportunities to more fully document the role of the senior agency official for privacy in these activities. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Office of Personnel Management | The Director of OPM should fully develop and document a privacy continuous monitoring strategy. (Recommendation 57) |
The Office of Personnel Management partially concurred with this recommendation, stating that it will further evaluate its approach to privacy continuous monitoring and review the need for more comprehensive documentation. As of February 2023, OPM had not provided any updates on further actions taken to address this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Small Business Administration | The Administrator of SBA should fully define and document a process for ensuring that the senior agency official for privacy or other designated privacy official is involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy. (Recommendation 58) |
SBA stated that it agreed with our recommendation and was developing plans to address it. As of February 2023, SBA had not provided any updates on further actions taken to address this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Social Security Administration | The Commissioner of SSA should define and document procedures for coordination between privacy and information security functions. (Recommendation 59) |
SSA stated that it agreed with our recommendation. As of February 2023, SSA had not provided any updates on further actions taken to address this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Social Security Administration | The Commissioner of SSA should fully define and document a process for ensuring that the senior agency official for privacy, or other designated privacy official, reviews IT capital investment plans and budgetary requests to ensure privacy requirements and associated controls are explicitly identified and included with respect to any IT resources that will involve PII. (Recommendation 60) |
SSA stated that it agreed with our recommendation. As of February 2023, SSA had not provided any updates on further actions taken to address this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Social Security Administration | The Commissioner of SSA should fully define and document a process for ensuring that the senior agency official for privacy or other designated privacy official is involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy. (Recommendation 61) |
SSA stated that it agreed with our recommendation. As of February 2023, SSA had not provided any updates on further actions taken to address this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| Social Security Administration | The Commissioner of SSA should establish a time frame for fully defining the role of the senior agency official for privacy or other designated privacy official in reviewing and approving system categorizations, overseeing privacy control assessments, and reviewing authorization packages, and document these roles. (Recommendation 62) |
SSA stated that it agreed with our recommendation. As of February 2023, SSA had not provided any updates on further actions taken to address this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.
|
| U.S. Agency for International Development | The Administrator of USAID should fully define and document a process for ensuring that the senior agency official for privacy, or other designated privacy official, reviews IT capital investment plans and budgetary requests. (Recommendation 63) |
USAID stated that it agreed with our recommendation and described plans to address it. In February 2023, USAID provided evidence showing that it had taken action to address the recommendation. Specifically, USAID took steps to ensure that its Senior Agency Official for Privacy (SAOP) is included as a permanent voting member of the agency's Information Technology Steering Subcommittee (ITSS). The ITSS is an Agency-wide executive IT investment governance body made up of executive representatives from across the agency participate on the ITSS to provide input on business and program needs and make recommendations on investment priorities. The responsibilities of the SAOP include evaluating the privacy impact of all new technology, including its impact on personally identifiable information (PII). Accordingly, we considered this recommendation to be implemented. By establishing this process, USAID is better equipped to ensure privacy requirements and associated controls are explicitly identified and included with respect to any IT resources that will involve PII.
|
| U.S. Agency for International Development | The Administrator of USAID should incorporate privacy into an organization-wide risk management strategy that includes a determination of risk tolerance. (Recommendation 64) |
USAID stated that it agreed with our recommendation and described plans to address it. In February 2023, USAID provided evidence that it had incorporated privacy, including a determination of risk tolerance, into its risk management strategy. Specifically, the agency updated its risk appetite statement to acknowledge the overlap between privacy and cybersecurity risks as well as other privacy-related risks to better inform decision-making. This includes incorporating privacy considerations into its risk appetite related to various aspects of the IT risk facing the agency. Accordingly, we consider this recommendation to be implemented. By taking these steps, USAID is better positioned to manage privacy risks within acceptable thresholds.
|