Which references support PL-5 Privacy Impact Assessment?

• A. E-gov sec. 208 and OMB M-03-22
• B. OMB M-02-01 and SP 800-37
• C. SP 800-34 and FCD-1
• D. HSPD-7 and SP 800-53

Answer: (A)

PIA work hinges on recognizing privacy risks in information systems and documenting how they’re addressed. The strongest references for PL-5 Privacy Impact Assessment are the E-Government Act, Section 208, which requires agencies to conduct PIAs for information systems that collect or maintain PII, and OMB Memorandum M-03-22, which provides the federal implementation guidance for performing those PIAs. Together, they establish the legal basis and the process for PIAs that PL-5 covers.

Other options focus on different areas: contingency planning (SP 800-34), general risk management (SP 800-37), cloud strategy (FCD-1), or security and infrastructure topics (HSPD-7 and SP 800-53) and do not specifically establish or implement privacy impact assessments.