+SC-42(05) Collection Minimization
|
SC-42(05) Collection Minimization
Control
Employ [Assignement: sensors] that are configured to minimize the collection of information about individuals that is not needed.
Discussion
Although policies to control for authorized use can be applied to information once it is collected, minimizing the collection of information that is not needed mitigates privacy risk at the system entry point and mitigates the risk of policy control failures. Sensor configurations include the obscuring of human features, such as blurring or pixelating flesh tones.
Assessment Objective
the [Assignement: sensors] configured to minimize the collection of information about individuals that is not needed are employed.
Assessment Method
Examine
System and communications protection policy
access control policy and procedures
personally identifiable information processing policy
sensor capability and data collection policy and procedures
system design documentation
system configuration settings and associated documentation
privacy risk assessment documentation
privacy impact assessments
system architecture
list of information being collected by sensors
list of sensor configurations that minimize the collection of personally identifiable information (e.g., obscure human features)
system audit records
system security plan
privacy plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security and privacy responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for sensor capabilities
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|