Access mechanisms (e.g., request forms and application interfaces)
access control policy
procedures addressing access enforcement
system design documentation
system configuration settings and associated documentation
documentation regarding access to an individual’s personally identifiable information
system audit records
system security plan
privacy plan
privacy impact assessment
privacy assessment findings and/or reports
other relevant documents or records