Control statement
Implement [Organization-defined: tools or mechanisms] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.
Discussion
Consent allows individuals to participate in making decisions about the processing of their information and transfers some of the risk that arises from the processing of personally identifiable information from the organization to an individual. Consent may be required by applicable laws, executive orders, directives, regulations, policies, standards, or guidelines. Otherwise, when selecting consent as a control, organizations consider whether individuals can be reasonably expected to understand and accept the privacy risks that arise from their authorization. Organizations consider whether other controls may more effectively mitigate privacy risk either alone or in conjunction with consent. Organizations also consider any demographic or contextual factors that may influence the understanding or behavior of individuals with respect to the processing carried out by the system or organization. When soliciting consent from individuals, organizations consider the appropriate mechanism for obtaining consent, including the type of consent (e.g., opt-in, opt-out), how to properly authenticate and identity proof individuals and how to obtain consent through electronic means. In addition, organizations consider providing a mechanism for individuals to revoke consent once it has been provided, as appropriate. Finally, organizations consider usability factors to help individuals understand the risks being accepted when providing consent, including the use of plain language and avoiding technical jargon.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Consent as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to privacy authority, purpose, transparency, consent, individual rights, and data-processing governance.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- privacy notices and consent records
- authority and purpose documentation
- data-processing inventories
- individual request and redress records
Common failure patterns
- collection justified by convenience rather than authority
- notices do not reflect actual processing
- secondary use expands without review
- retention and deletion commitments not enforced
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
the [Organization-defined: tools or mechanisms] are implemented for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.
Examine
- Personally identifiable information processing and transparency policy and procedures
- consent policies and procedures
- consent tools and mechanisms
- consent presentation or display (user interface)
- evidence of individuals’ consent
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for the collection of personally identifiable information
- consent tools or mechanisms for users to authorize the processing of their personally identifiable information
- mechanisms implementing consent
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
PT-4(1) — Tailored Consent
Provide [Organization-defined: mechanisms] to allow individuals to tailor processing permissions to selected elements of personally identifiable information.
Official discussion
While some processing may be necessary for the basic functionality of the product or service, other processing may not. In these circumstances, organizations allow individuals to select how specific personally identifiable information elements may be processed. More tailored consent may help reduce privacy risk, increase individual satisfaction, and avoid adverse behaviors, such as abandonment of the product or service.
Organization-defined parameters (1)
Assessment objectives and methods
[Organization-defined: mechanisms] are provided to allow individuals to tailor processing permissions to selected elements of personally identifiable information.
Examine
- Personally identifiable information processing and transparency policy and procedures
- consent policies and procedures
- consent tools and mechanisms
- consent presentation or display (user interface)
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with user interface or user experience responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for consenting to the processing of personally identifiable information
- consent tools or mechanisms
- mechanisms implementing consent
Related controls
PT-4(2) — Just-in-time Consent
Present [Organization-defined: consent mechanisms] to individuals at [Organization-defined: frequency] and in conjunction with [Organization-defined: personally identifiable information processing].
Official discussion
Just-in-time consent enables individuals to participate in how their personally identifiable information is being processed at the time or in conjunction with specific types of data processing when such participation may be most useful to the individual. Individual assumptions about how personally identifiable information is being processed might not be accurate or reliable if time has passed since the individual last gave consent or the type of processing creates significant privacy risk. Organizations use discretion to determine when to use just-in-time consent and may use supporting information on demographics, focus groups, or surveys to learn more about individuals’ privacy interests and concerns.
Organization-defined parameters (3)
Assessment objectives and methods
[Organization-defined: consent mechanisms] are presented to individuals [Organization-defined: frequency] and in conjunction with [Organization-defined: personally identifiable information processing].
Examine
- Personally identifiable information processing and transparency policy and procedures
- consent policies and procedures
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with user interface or user experience responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for the collection of personally identifiable information
- mechanisms for obtaining just-in-time consent from users for the processing of their personally identifiable information
- mechanisms implementing just-in-time consent
Related controls
PT-4(3) — Revocation
Implement [Organization-defined: tools or mechanisms] for individuals to revoke consent to the processing of their personally identifiable information.
Official discussion
Revocation of consent enables individuals to exercise control over their initial consent decision when circumstances change. Organizations consider usability factors in enabling easy-to-use revocation capabilities.
Organization-defined parameters (1)
Assessment objectives and methods
the [Organization-defined: tools or mechanisms] are implemented for individuals to revoke consent to the processing of their personally identifiable information.
Examine
- Personally identifiable information processing and transparency policy and procedures
- consent revocation policies and procedures
- consent revocation user interface or user experience
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with user interface or user experience responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for consenting to the processing of personally identifiable information
- tools or mechanisms for implementing consent revocation
Related controls
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.