A formal document that details the privacy controls selected for an information system or environment of operation that are in place or planned for meeting applicable privacy requirements and managing privacy risks, details how the controls have been implemented, and describes the methodologies and metrics that will be used to assess the controls.
Sources:
CNSSI 4009-2022
from
OMB Circular A-130 (2016)
NIST SP 800-18r2
from
OMB Circular A-130 (2016)
NIST SP 800-37 Rev. 2
from
OMB Circular A-130 (2016)
NIST SP 800-53 Rev. 5
from
OMB Circular A-130 (2016)
NIST SP 800-53A Rev. 5
from
OMB Circular A-130 (2016)
NIST SP 800-53B
from
OMB Circular A-130 (2016)