How do you demonstrate compliance with privacy requirements in RMF?

• A. Privacy is optional and not mapped to SP 800-53.
• B. Include privacy controls and mapping to SP 800-53 privacy-related controls; document in the SSP and risk assessment.
• C. Privacy requirements are demonstrated solely through data encryption.
• D. Privacy controls are described in the system architecture diagram only.

Answer: (B)

In RMF, showing privacy compliance means treating privacy as an integral set of controls that are selected, implemented, and assessed just like security controls. You demonstrate this by including privacy controls and explicitly mapping them to SP 800-53 privacy-related controls, then providing concrete evidence in the System Security Plan and in the risk assessment. This creates traceability from policy and regulatory requirements to the actual safeguards and the evaluation results, and it shows how PII is handled throughout its lifecycle—collection, use, sharing, retention, access, and disposal—within the system’s boundaries and processes.

The SSP documents how each privacy control is implemented, who is responsible, what data flows look like, and how safeguards are operated and tested. The risk assessment analyzes privacy-specific risks, such as potential exposure of PII or non-compliance with consent and data retention rules, and records the mitigations and residual risk.

Relying solely on encryption addresses confidentiality but misses other privacy aspects like purpose limitation, data minimization, consent, and rights of data subjects. Describing privacy only in the system architecture diagram fails to provide the required evidence, testing, and ongoing monitoring needed to prove compliance.