Assessment Objective

Determine if:

• SC-42(04) [Assignment: measures] are employed to facilitate an individual’s awareness that personally identifiable information is being collected by [Assignment: sensors]

Assessment Methods

Examine

• System and communications protection policy
• access control policy and procedures
• personally identifiable information processing policy
• sensor capability and data collection policy and procedures
• system design documentation
• system configuration settings and associated documentation
• privacy risk assessment documentation
• privacy impact assessments
• system architecture
• list of measures to be employed to ensure that individuals are aware that personally identifiable information is being collected by sensors
• examples of notifications provided to individuals that personally identifiable information is being collected by sensors
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy responsibilities
• organizational personnel installing, configuring, and/or maintaining the system
• organizational personnel responsible for sensor capabilities

Test

• Mechanisms supporting and/or implementing measures to facilitate an individual’s awareness that personally identifiable information is being collected by sensors
• sensor information collection capabilities for the system

Свързани задачи

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final