NIST Privacy Framework, Govern-PGV.MT-P3

If your business meets the CCPA's business-scale thresholds, deriving 50 percent or more of annual revenue from selling or sharing personal information, or having more than $25 million in annual gross revenue and having processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the preceding calendar year, complete a cybersecurity audit.

Complete that audit using a qualified, objective, independent auditor, who may be internal or external to the business, and who did not develop, implement, or maintain the cybersecurity program being audited.

If you process personal data, apply the principles in Article 5(1) to that processing; if you are the controller, you are responsible for compliance with them and must be able to demonstrate it (Article 5(1) and (2)).

If you are the controller, be responsible for, and be able to demonstrate compliance with, each of the principles in Article 5(1) (Article 5(2)).

Establish formal procedures implementing these principles, and review them, with a self-assessment, at least once every five years.

Be able to demonstrate compliance with these principles on request of the competent authority, the Economic Policy, Planning and Statistics Office.

Have one of the lawful bases Article 7 lists, such as the data subject's consent, performance of a contract or a legal obligation, before processing the personal data of a person in Montenegro, and be able to show that you comply with the principles in Article 6.

Register with the Commission as a data controller or data processor of major importance where the Commission so determines, conduct a compliance audit within fifteen months of commencing business and annually thereafter, and file Compliance Audit Returns by 31 March each year in the Ultra-High and Extra-High Level categories.

Take appropriate technical, organizational and staff measures proportionate to the processing's risk, keep them under review, and be able to demonstrate compliance.

Take appropriate technical and organizational measures so you can demonstrate compliance with this law on request, and require anyone with access to personal data under your authority to keep it confidential or be bound by a legal duty of confidentiality.

Each Party is able to demonstrate compliance with the Clauses, and the data importer keeps appropriate documentation of its processing and makes it available to the competent supervisory authority on request (Clause 8.9 in Modules One to Three).

Be prepared to demonstrate the effectiveness of your transfer safeguards to the Commissioner on request.

Be ready to demonstrate compliance with the transfer safeguards this Law requires, including where a transfer rests on your own compelling legitimate interests, and expect the supervisory authority to prohibit or suspend an outbound transfer to protect data subjects' rights.

Be ready to demonstrate to the Superintendencia de Industria y Comercio, on its request, that you have implemented measures that are appropriate and effective to comply with Ley 1581 de 2012 and Decreto 1074 de 2015 for any artificial intelligence system that processes personal data.

Keep concrete evidence of compliance with each provision you may be complained about: registration, annual Compliance Audit Returns, a filed impact assessment and an approved cross-border transfer instrument show good faith but do not answer a complaint about anything else.

Maintain a record of processing activities and audit the AI system's operation in proportion to its level of risk.

Give the management body effective oversight and control over the recording policies and procedures, keep the arrangements technology-neutral and evaluate them periodically (adopting further measures at least when a new medium of communication is accepted or permitted), keep and regularly update a record of the individuals with firm devices or approved privately owned devices, train employees in the procedures, monitor the records of transactions and orders periodically on a risk-based and proportionate basis, and demonstrate the policies, procedures and management oversight to the competent authorities on request (Article 76(2) to (7)).

At the medium or high tier, conduct an internal or external audit of compliance with these Regulations at least once every 24 months.