Access control policy
privacy and security policies, procedures addressing system use notification
documented approval of system use notification messages or banners
system audit records
user acknowledgements of notification message or banner
system design documentation
system configuration settings and associated documentation
system use notification messages
system security plan
privacy plan
privacy impact assessment
privacy assessment report
other relevant documents or records