Control statement
When a system or organization processes information for the purpose of conducting a matching program:
- a.Obtain approval from the Data Integrity Board to conduct the matching program;
- b.Develop and enter into a computer matching agreement;
- c.Publish a matching notice in the Federal Register;
- d.Independently verify the information produced by the matching program before taking adverse action against an individual, if required; and
- e.Provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual.
Discussion
The [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) establishes requirements for federal and non-federal agencies if they engage in a matching program. In general, a matching program is a computerized comparison of records from two or more automated [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) systems of records or an automated system of records and automated records maintained by a non-federal agency (or agent thereof). A matching program either pertains to federal benefit programs or federal personnel or payroll records. A federal benefit match is performed to determine or verify eligibility for payments under federal benefit programs or to recoup payments or delinquent debts under federal benefit programs. A matching program involves not just the matching activity itself but also the investigative follow-up and ultimate action, if any.
From control text to operational evidence
Use Computer Matching Requirements as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to privacy authority, purpose, transparency, consent, individual rights, and data-processing governance.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- privacy notices and consent records
- authority and purpose documentation
- data-processing inventories
- individual request and redress records
Common failure patterns
- collection justified by convenience rather than authority
- notices do not reflect actual processing
- secondary use expands without review
- retention and deletion commitments not enforced
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- PT-08a.approval to conduct the matching program is obtained from the Data Integrity Board when a system or organization processes information for the purpose of conducting a matching program;
- PT-08b.
- PT-08b.[01]a computer matching agreement is developed when a system or organization processes information for the purpose of conducting a matching program;
- PT-08b.[02]a computer matching agreement is entered into when a system or organization processes information for the purpose of conducting a matching program;
- PT-08c.a matching notice is published in the Federal Register when a system or organization processes information for the purpose of conducting a matching program;
- PT-08d.the information produced by the matching program is independently verified before taking adverse action against an individual, if required, when a system or organization processes information for the purpose of conducting a matching program;
- PT-08e.
- PT-08e.[01]individuals are provided with notice when a system or organization processes information for the purpose of conducting a matching program;
- PT-08e.[02]individuals are provided with an opportunity to contest the findings before adverse action is taken against them when a system or organization processes information for the purpose of conducting a matching program.
Examine
- Personally identifiable information processing and transparency policy and procedures
- privacy notice
- Privacy Act system of records
- Federal Register notices
- Data Integrity Board determinations
- contracts
- information sharing agreements
- memoranda of understanding
- governing requirements
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for supporting and/or implementing personally identifiable information processing
- matching program
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.