AICPA Privacy Management Framework (PMF)
What is AICPA Privacy Management Framework (PMF)?
The AICPA Privacy Management Framework (PMF) provides a comprehensive framework for CPA practitioners and organisations to manage and report on privacy risk. It builds on the Generally Accepted Privacy Principles (GAPP) and SOC 2 Trust Services Criteria for Privacy. It comprises 26 controls organised across 9 domains, and applies in the United States (AICPA).
How AICPA Privacy Management Framework (PMF) maps to other frameworks
All 26 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 9 domains AICPA Privacy Management Framework (PMF) groups its controls into
Frameworks that share controls with AICPA Privacy Management Framework (PMF)
Each of these has at least one control mapped to a control in AICPA Privacy Management Framework (PMF). The number is how many AICPA Privacy Management Framework (PMF) controls are shared, counted from the mapping graph.
GDPR
26 shared controlsUK GDPR (UK General Data Protection Regulation)
7 shared controlsSSAE 18 - Attestation Standards (SOC Reporting)
7 shared controlsFTC GLBA Safeguards Rule (16 CFR Part 314)
7 shared controlsVirginia CDPA
6 shared controlsUruguay DPL
6 shared controlsTexas Data Privacy Act
6 shared controlsTaiwan PDPA
6 shared controlsImplementation guides for frameworks that overlap AICPA Privacy Management Framework (PMF)
Where AICPA Privacy Management Framework (PMF) overlaps with the standards you already hold
Where to get trained on AICPA Privacy Management Framework (PMF)
One course in the catalogue covers AICPA Privacy Management Framework (PMF) directly. Each is self-paced, includes the downloadable toolkit and the implementation playbook, and carries a certificate of completion.
Training more than one person? Ten seats of any course is $1,490 on a single licence, against $199 a seat bought one at a time.
What an auditor will ask you for
All 26 AICPA Privacy Management Framework (PMF) controls, each with what it requires, the artefacts an auditor will ask you for, and where it commonly fails. Free to read, nothing to fill in.
Read the AICPA Privacy Management Framework (PMF) evidence request listWhat AICPA Privacy Management Framework (PMF) means in your sector
What AICPA Privacy Management Framework (PMF) means for your job
Questions people ask about AICPA Privacy Management Framework (PMF)
What is AICPA Privacy Management Framework?
How many controls does AICPA Privacy Management Framework have?
Where does AICPA Privacy Management Framework apply?
What frameworks does AICPA Privacy Management Framework map to?
How do I get started with AICPA Privacy Management Framework compliance?
Query AICPA Privacy Management Framework (PMF) programmatically
AICPA Privacy Management Framework (PMF), its 26 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
AICPA Privacy Management Framework (PMF) API reference and MCP config →What AICPA Privacy Management Framework (PMF) requires, control by control
Each page carries the requirement text for one AICPA Privacy Management Framework (PMF) control and what an assessor expects to see as evidence.
- PMF-A-1 Individual Access Rights
- PMF-A-2 Access Request Process
- PMF-AN-1 Privacy Notice
- PMF-AN-2 Purpose Specification
- PMF-AN-3 Privacy Agreements
- PMF-CC-1 Lawful and Fair Collection
- PMF-CC-2 Collection Limitation
- PMF-CC-3 Consent Mechanisms
- PMF-D-1 Third-Party Disclosure Controls
- PMF-D-2 Third-Party Agreements
How ready are you for AICPA Privacy Management Framework (PMF)?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.