RSA 126-A:105 Risk Management.

I. The department shall conduct a written risk assessment and mitigation remediation plan in the form of a privacy impact assessment (PIA).
II. The assessment and plan shall:
(a) Assess risks to an individual's right to privacy within the department's information technology systems where the individual does not possess immediate control over their information.
(b) Recommend alternatives to both mitigate the risks and achieve the stated objectives of the department's systems.
(c) Identify those individuals and offices within the department who shall be directly accountable for the assessment and plan, the system at the time the assessment and plan are compiled, and any approved alternatives and mitigations as a result of the assessment and plan.
III. Unl