PT-8

Discussion

The PRIVACT establishes requirements for federal and non-federal agencies if they engage in a matching program. In general, a matching program is a computerized comparison of records from two or more automated PRIVACT systems of records or an automated system of records and automated records maintained by a non-federal agency (or agent thereof). A matching program either pertains to federal benefit programs or federal personnel or payroll records. A federal benefit match is performed to determine or verify eligibility for payments under federal benefit programs or to recoup payments or delinquent debts under federal benefit programs. A matching program involves not just the matching activity itself but also the investigative follow-up and ultimate action, if any.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Personally identifiable information processing and transparency policy and procedures; privacy notice; Privacy Act system of records; Federal Register notices; Data Integrity Board determinations; contracts; information sharing agreements; memoranda of understanding; governing requirements; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Organizational processes for supporting and/or implementing personally identifiable information processing; matching program].

ID	Assessment Objectives
PT-08b.[01]	a computer matching agreement is developed when a system or organization processes information for the purpose of conducting a matching program;
PT-08b.[02]	a computer matching agreement is entered into when a system or organization processes information for the purpose of conducting a matching program;
PT-08c.	a matching notice is published in the Federal Register when a system or organization processes information for the purpose of conducting a matching program;
PT-08d.	the information produced by the matching program is independently verified before taking adverse action against an individual, if required, when a system or organization processes information for the purpose of conducting a matching program;
PT-08e.[01]	individuals are provided with notice when a system or organization processes information for the purpose of conducting a matching program;
PT-08e.[02]	individuals are provided with an opportunity to contest the findings before adverse action is taken against them when a system or organization processes information for the purpose of conducting a matching program.
PT-08a.	approval to conduct the matching program is obtained from the Data Integrity Board when a system or organization processes information for the purpose of conducting a matching program;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!