+SA-15(12) Minimize Personally Identifiable Information

SA-15(12) Minimize Personally Identifiable Information

Control

Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.

Discussion

Organizations can minimize the risk to an individual’s privacy by using techniques such as de-identification or synthetic data. Limiting the use of personally identifiable information in development and test environments helps reduce the level of privacy risk created by a system.

Assessment Objective

the developer of the system or system component is required to minimize the use of personally identifiable information in development and test environments.

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures procedures addressing the development process procedures addressing the minimization of personally identifiable information in testing, training, and research personally identifiable information processing policy procedures addressing the authority to test with personally identifiable information standards and tools solicitation documentation service level agreements acquisition contracts for the system or services system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities system developer

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by SA-15(12) Minimize Personally Identifiable Information – Assessment Procedure
is blocked by Limit Sensitive / Regulated Data In Testing, Training & Research