← Controls / PT

PT-08 Computer Matching Requirements

Personally Identifiable Information Processing and Transparency

Privacy New in Rev 5

Description

When a system or organization processes information for the purpose of conducting a matching program: a. Obtain approval from the Data Integrity Board to conduct the matching program; b. Develop and enter into a computer matching agreement; c. Publish a matching notice in the Federal Register; d. Independently verify the information produced by the matching program before taking adverse action against an individual, if required; and e. Provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual.

Supplemental Guidance

The [PRIVACT] establishes requirements for federal and non-federal agencies if they engage in a matching program. In general, a matching program is a computerized comparison of records from two or more automated [PRIVACT] systems of records or an automated system of records and automated records maintained by a non-federal agency (or agent thereof). A matching program either pertains to federal benefit programs or federal personnel or payroll records. A federal benefit match is performed to determine or verify eligibility for payments under federal benefit programs or to recoup payments or delinquent debts under federal benefit programs. A matching program involves not just the matching activity itself but also the investigative follow-up and ultimate action, if any.

Changes from Rev 4

New control family introduced in Rev 5

Compliance Mappings

ISO 27001:2022

A.5.34

ISO 27002:2022

5.34

COBIT 2019

APO14

CIS Controls v8

CIS 3

ISO 42001:2023

A.5.4

BSI IT-Grundschutz

CON.2

ANSSI

SecNumCloud.19.3

EU GDPR

Art.22(1)Art.22(2)Art.22(3)Art.22(4)

BIO2

5.34

RBI CSF

Annex1.15

CBUAE

CR-5

CBE CSF

CTO-2

POPIA

s71

BOT Cyber Resilience

Ch9.2

Common Criteria

CC Part 2 — FPR

Lloyd's Minimum Standards

MS7.1

NHS DSPT

NDG-6.2

MiCA

Art.98(1)