Actions Have Been Taken to Improve the Privacy Program; However, Some Privacy Controls Have Not Been Fully Implemented and Assessed

The Chief Privacy Officer should develop a process to track and ensure that preparers of rejected PCLIAs complete the appropriate privacy awareness training as required.

Prioritize the implementation of the remaining NIST, SP 800-53, Revision 5, privacy controls not assessed in FISMA Year 2022 to ensure adherence to Federal requirements.

Ensure that all assessed privacy control results are correctly applied to all fields in the new assessment and monitoring system and captured in the SSPs.

The Chief Privacy Officer should ensure that privacy controls for cloud systems are implemented within one year from when updated FedRAMP guidance is approved and released. However, if this is not feasible, the privacy controls should be implemented following the current established continuous monitoring testing plan.

The Human Capital Officer should implement a process to track and monitor compliance with privacy training requirements for all contractors.