Assessment Objective
Determine if:
- SI-19(02) the archiving of personally identifiable information elements is prohibited if those elements in a dataset will not be needed after the dataset is archived.
Assessment Methods
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- de-identification procedures
- system configuration documentation
- data archiving mechanisms
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel responsible for de-identifying the dataset
- organizational personnel with dataset archival responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Automated mechanisms prohibiting the archival of personally identifiable information elements
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | SI-19(02) Archiving |