Each state agency shall complete a "Privacy Risk Assessment" that is authorized by the CIO, for all online applications. The agency shall maintain a copy of each completed assessment for a period of four years for the purpose of providing audit documentation.
Utah Admin. Code R895-8-8