Assessment Objective

Determine if:

• PM-22[01] organization-wide policies for personally identifiable information quality management are developed and documented;
• PM-22[02] organization-wide procedures for personally identifiable information quality management are developed and documented;
• PM-22a.
  • PM-22a.[01] the policies address reviewing the accuracy of personally identifiable information across the information life cycle;
  • PM-22a.[02] the policies address reviewing the relevance of personally identifiable information across the information life cycle;
  • PM-22a.[03] the policies address reviewing the timeliness of personally identifiable information across the information life cycle;
  • PM-22a.[04] the policies address reviewing the completeness of personally identifiable information across the information life cycle;
  • PM-22a.[05] the procedures address reviewing the accuracy of personally identifiable information across the information life cycle;
  • PM-22a.[06] the procedures address reviewing the relevance of personally identifiable information across the information life cycle;
  • PM-22a.[07] the procedures address reviewing the timeliness of personally identifiable information across the information life cycle;
  • PM-22a.[08] the procedures address reviewing the completeness of personally identifiable information across the information life cycle;
• PM-22b.
  • PM-22b.[01] the policies address correcting or deleting inaccurate or outdated personally identifiable information;
  • PM-22b.[02] the procedures address correcting or deleting inaccurate or outdated personally identifiable information;
• PM-22c.
  • PM-22c.[01] the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
  • PM-22c.[02] the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
• PM-22d.
  • PM-22d.[01] the policies address appeals of adverse decisions on correction or deletion requests;
  • PM-22d.[02] the procedures address appeals of adverse decisions on correction or deletion requests.

Assessment Methods

Examine

• Privacy program plan
• policies and procedures addressing personally identifiable information quality management, information life cycle documentation, and sample notices of correction or deletion
• records of monitoring PII quality management practices
• documentation of reviews and updates of policies and procedures

Interview

• Organizational personnel with privacy program information dissemination responsibilities
• organizational personnel with privacy responsibilities

Test

• [Organizational processes for data quality and personally identifiable information quality management procedures
• mechanisms supporting and/or implementing quality management requirements

Verknüpfte Vorgänge

• NIST -

  EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

  DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.