What does M-06-15 Safeguarding PII require?

• A. Requires privacy policies for each agency and the public release of these policies
• B. Requires PIA for the first time in government
• C. Requires encryption of all PII at rest
• D. Requires annual security training for staff

Answer: (A)

The main idea is that safeguarding PII in this context centers on transparency about how personal data is handled. M-06-15 requires each agency to maintain a privacy policy for PII and to publish those policies so the public can read exactly how PII is collected, used, disclosed, safeguarded, retained, and disposed of. This public visibility helps individuals understand what happens to their information and holds agencies accountable for protecting it.

While other privacy and security practices matter, they aren’t the specific mandate of this memo. For example, privacy impact assessments and encryption requirements, or mandatory annual security training, are governed by other guidance or programs. The emphasis of M-06-15 is the publication of agency privacy policies describing PII handling.