Assessment Objective
Determine if:
- SI-19(03) personally identifiable information elements are removed from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.
Assessment Methods
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- de-identification procedures
- procedures for minimizing the release of personally identifiable information
- system configuration
- data release mechanisms
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel responsible for de-identifying the dataset
- organizational personnel with information security and privacy responsibilities
Test
- Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements from a dataset
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | SI-19(03) Release |