Assessment Objective
Determine if:
- PE-08(03) personally identifiable information contained in visitor access records is limited to [Assignment: elements] identified in the privacy risk assessment.
Assessment Methods
Examine
- Physical and environmental protection policy
- personally identifiable information processing policy
- privacy risk assessment documentation
- privacy impact assessment
- visitor access records
- personally identifiable information inventory
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with visitor access records responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for maintaining and reviewing visitor access records
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | PE-08(03) [P] Limit Personally Identifiable Information Elements |