+SI-12(01) [P] Limit Personally Identifiable Information Elements

SI-12(01) [P] Limit Personally Identifiable Information Elements

Control

Limit personally identifiable information being processed in the information life cycle to the following elements of personally identifiable information: [Assignement: elements of personally identifiable information].

Discussion

Limiting the use of personally identifiable information throughout the information life cycle when the information is not needed for operational purposes helps to reduce the level of privacy risk created by a system. The information life cycle includes information creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposition. Risk assessments as well as applicable laws, regulations, and policies can provide useful inputs to determining which elements of personally identifiable information may create risk.

Assessment Objective

personally identifiable information being processed in the information life cycle is limited to [Assignement: elements of personally identifiable information].

Assessment Method

Examine

System and information integrity policy system and information integrity procedures personally identifiable information processing policy personally identifiable information processing procedures records retention and disposition policy records retention and disposition procedures federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to limiting personally identifiable information elements personally identifiable information inventory system audit records audit findings system security plan privacy plan privacy program plan privacy impact assessment privacy risk assessment documentation data mapping documentation other relevant documents or records

Interview

Organizational personnel with information and records management, retention, and disposition responsibilities organizational personnel with security and privacy responsibilities network administrators

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by SI-12(01) [P] Limit Personally Identifiable Information Elements – Assessment Procedure
is blocked by Minimize Sensitive / Regulated Data Exposure
is blocked by Internal Use of Personal Data (PD) For Testing, Training and Research