Sign off with PbD-SE methodology check list For verification of findings through previous assessments and that proper documentation exist.. This step verifies that proper documentation exists. A checklist is useful for managers and responsible stakeholders to assess, at a glance, whether PbD principles are considered and privacy documentation generated and/or referenced. 3.1 shows an example RACI chart that can act as a checklist. It is expected that organizations will have different RACI assignments according to their specific contexts (e.g. size and organization). Table 3.1 RACI Chart for Software Engineers PbD-SE Documents to be Privacy Project Third Methodology referenced/produced item Resource Mgmt. Step 3.1 Reference Privacy Policy Organization-al Document CI RACI CI ACI I CI ✓ Readiness Privacy Roles/Training Program in I RACI CI AI I I ✓ Organization 3.2 Scope Functional Privacy Privacy Requirements, RA RACI ACI AI RAI CI ✓ Requirements & preliminary controls Reference identification & to Architecture Reference Architecture 3.3 Conduct Traceability diagrams Risk and and other CI RACI CI AC CI - ✓ Privacy documentation to show Property consideration of privacy Analysis properties Risk analysis CI RACI CI ACI CI Final controls - ✓ identification 3.4 Identify Privacy resource I RACI RI AI I - Privacy allocation to SE team ✓ Resource Allocation 3.5 Create RACI assignment to RCI CI RACI AI - - ✓ artifact production RACI for Producing Artifacts 3.6 Customize Privacy Architecture Privacy (incl. services RA ACI A CI AI I - ✓ Architecture identification) 3.7 Conduct Review of Artifacts RA CI RACI AI - - ✓ Periodic Review throughout the PDLC
Sign off with PbD-SE methodology check list For verification of findings through previous assessments and that proper documentation exist.. This step verifies that proper documentation exists. A checklist is useful for managers and responsible stakeholders to assess, at a glance, whether PbD principles are considered and privacy documentation generated and/or referenced. 3.1 shows an example RACI chart that can act as a checklist. It is expected that organizations will have different RACI assignments according to their specific contexts (e.g. size and organization). Table 3.1 RACI Chart for Software Engineers PbD-SE Methodology Step Documents to be referenced/produced Privacy Resource Project Mgmt. Third item 3.1 Reference Organization-al Readiness Privacy Policy Document CI RACI CI ACI I CI ✓ Privacy Roles/Training Program in Organization I RACI CI AI I I ✓ 3.2 Scope Privacy Requirements & Reference Architecture Functional Privacy Requirements, preliminary controls identification & to Reference Architecture RA RACI ACI AI RAI CI ✓ 3.3 Conduct Risk and Privacy Property Analysis Traceability diagrams and other documentation to show consideration of privacy properties CI RACI CI AC CI - ✓ Risk analysis Final controls identification CI RACI CI ACI CI - ✓ 3.4 Identify Privacy Resource Allocation Privacy resource allocation to SE team I RACI RI AI I - ✓ 3.5 Create RACI for Producing Artifacts RACI assignment to artifact production RCI CI RACI AI - - ✓ 3.6 Customize Privacy Architecture Privacy Architecture (incl. services identification) RA ACI A CI AI I - ✓ 3.7 Conduct Periodic Review Review of Artifacts throughout the PDLC RA CI RACI AI - - ✓
pbd-se-v1_0-wd04-sabo_comments.docx