Sign off with PbD-SE methodology check list This step verifies that proper documentation exists. A checklist MAY be useful for managers and responsible stakeholders to assess, at a glance, whether PbD principles are considered and privacy documentation generated and/or referenced. Table 3.1 shows an example RACI chart that can act as a checklist. It is expected that organizations will have different RACI assignments according to their specific contexts (e.g. size and organization). Table 3.1 RACI Chart for Software Engineers PbD-SE Documents to be Privacy Project Third Methodology referenced/produced item Resource Mgmt. Party Step 3.1 Reference Privacy Policy Organization-al Document CI RACI CI ACI I CI ✓ Readiness Privacy Program in I RACI CI AI I I ✓ Organization 3.2 Privacy Functional Privacy Requirements & Requirements, RA RACI ACI AI RAI CI ✓ Reference preliminary controls Architecture identification & hooks to Reference Architecture 3.3 Conduct Traceability diagrams Risk and and other CI RACI CI AC CI - ✓ Privacy documentation to show Property consideration of privacy Analysis properties Risk analysis CI RACI CI ACI CI Final controls - ✓ identification 3.4 Identify Privacy resource I RACI RI AI I - Privacy allocation to SE team ✓ Resource Allocation 3.5 Create RACI assignment to RCI CI RACI AI - - ✓ artifact production RACI for Producing Artifacts 3.6 Customize Privacy Architecture Privacy (incl. services RA ACI A CI AI I - ✓ Architecture identification) 3.7 Conduct Review of Artifacts RA CI RACI AI - - ✓ Periodic Review throughout the SDLC
Sign off with PbD-SE methodology check list This step verifies that proper documentation exists. A checklist MAY be useful for managers and responsible stakeholders to assess, at a glance, whether PbD principles are considered and privacy documentation generated and/or referenced. Table 3.1 shows an example RACI chart that can act as a checklist. It is expected that organizations will have different RACI assignments according to their specific contexts (e.g. size and organization). Table 3.1 RACI Chart for Software Engineers PbD-SE Methodology Step Documents to be referenced/produced Privacy Resource Project Mgmt. Third Party item 3.1 Reference Organization-al Readiness Privacy Policy Document CI RACI CI ACI I CI ✓ Privacy Program in Organization I RACI CI AI I I ✓ 3.2 Privacy Requirements & Reference Architecture Functional Privacy Requirements, preliminary controls identification & hooks to Reference Architecture RA RACI ACI AI RAI CI ✓ 3.3 Conduct Risk and Privacy Property Analysis Traceability diagrams and other documentation to show consideration of privacy properties CI RACI CI AC CI - ✓ Risk analysis Final controls identification CI RACI CI ACI CI - ✓ 3.4 Identify Privacy Resource Allocation Privacy resource allocation to SE team I RACI RI AI I - ✓ 3.5 Create RACI for Producing Artifacts RACI assignment to artifact production RCI CI RACI AI - - ✓ 3.6 Customize Privacy Architecture Privacy Architecture (incl. services identification) RA ACI A CI AI I - ✓ 3.7 Conduct Periodic Review Review of Artifacts throughout the SDLC RA CI RACI AI - - ✓
pbd-se-v1_0-wd04%20R3%20-%20without%20Section%202.docx