Which description best matches AR-2 Privacy Impact and Risk Assessment?

• A. Org privacy risk management processes operate across the life cycles of all mission/business processes that collect, use, maintain, share, or dispose of PII
• B. The organization develops, disseminates, and updates reports to OMB, Congress, and other oversight bodies
• C. The organization confirms the accuracy and relevance of PII
• D. NARA provides retention schedules for federal records

Answer: (A)

AR-2 focuses on weaving privacy risk management into every stage of how PII is handled. It means organizations assess privacy risks across the full lifecycle of all mission or business processes that collect, use, maintain, share, or dispose of PII, and apply safeguards accordingly. This proactive, lifecycle-based approach helps identify and mitigate privacy risks early in design and throughout operations.

The other descriptions don’t fit AR-2: reporting to oversight bodies is about governance and compliance reporting, not the ongoing privacy risk assessment; confirming the accuracy of PII is about data quality; and NARA retention schedules relate to records management, not privacy risk assessment.