Assessment Objective
Determine if:
- PT-02a. the [Assignment: authority] that permits the [Assignment: processing] of personally identifiable information is determined and documented;
- PT-02b. the [Assignment: processing] of personally identifiable information is restricted to only that which is authorized.
Assessment Methods
Examine
- Personally identifiable information processing and transparency policy and procedures
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for authorizing the processing of personally identifiable information
- mechanisms supporting and/or implementing the restriction of personally identifiable information processing
Свързани задачи
| Тип връзка | Задача |
|---|---|
| blocks | PT-02 [P] Authority to Process Personally Identifiable Information |