+SA-04(12) Data Ownership
|
SA-04(12) Data Ownership
Control
- Include organizational data ownership requirements in the acquisition contract; and
- Require all data to be removed from the contractor’s system and returned to the organization within [Assignement: time frame].
Discussion
Contractors who operate a system that contains data owned by an organization initiating the contract have policies and procedures in place to remove the data from their systems and/or return the data in a time frame defined by the contract.
Assessment Objective
- organizational data ownership requirements are included in the acquisition contract;
- all data to be removed from the contractor’s system and returned to the organization is required within [Assignement: time frame].
Assessment Method
Examine
System and services acquisition policy
system and services acquisition procedures
procedures addressing the integration of information security and privacy requirements, descriptions, and criteria into the acquisition process
procedures addressing the disposition of personally identifiable information
solicitation documentation
acquisition documentation
acquisition contracts for the system or system service
personally identifiable information processing policy
service level agreements
information sharing agreements
memoranda of understanding
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel with acquisition/contracting responsibilities
organizational personnel with the responsibility for data management and processing requirements
organizational personnel with information security and privacy responsibilities
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|