Formal document that catalogs the available privacy controls implemented at an agency across the agency risk management tiers and ensures that the controls are effectively monitored on an ongoing basis by assigning an agency- defined assessment frequency to each control that is sufficient to ensure compliance with applicable privacy requirements and to manage privacy risks.
Sources:
CNSSI 4009-2022
from
OMB Circular A-130 (2016)