id: "SA-04(11)" title: "System of Records" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-04.11" priority: "P1" implementation_level: "organization" parent: "SA-04" enhancement: True
Statement
Include {{ insert: param, sa-04.11_odp }} in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.
Guidance
When, by contract, an organization provides for the operation of a system of records to accomplish an organizational mission or function, the organization, consistent with its authority, causes the requirements of the PRIVACT to be applied to the system of records.
Assessment Objective
{{ insert: param, sa-04.11_odp }} are defined in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.
System and services acquisition policy
system and services acquisition procedures
procedures addressing the integration of Privacy Act requirements into systems of records operated by external organizations
solicitation documentation
acquisition documentation
acquisition contracts for the system, system component, or system service
service level agreements
system security plan
privacy plan
personally identifiable information processing policy
privacy program plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Organizational personnel with acquisition responsibilities
organizational personnel with information security and privacy responsibilities
Contract management processes to verify Privacy Act requirements are defined for the operation of a system of records
vendor processes for demonstrating incorporation of Privacy Act requirements in its operation of a system of records