+Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.2.0 PRIVACY BASELINE
---+AC [P] Access Control
------+AC-01 [P] Policy and Procedures
------+AC-03(14) [P] Individual Access
---+AT [P] Awareness and Training
------+AT-01 [P] Policy and Procedures
------+AT-02 [P] Literacy Training and Awareness
------+AT-03 [P] Role-based Training
---------+AT-03(05) [P] Processing Personally Identifiable Information
------+AT-04 [P] Training Records
---+AU [P] Audit and Accountability
------+AU-01 [P] Policy and Procedures
------+AU-02 [P] Event Logging
------+AU-03(03) [P] Limit Personally Identifiable Information Elements
------+AU-11 [P] Audit Record Retention
---+CA [P] Assessment, Authorization, and Monitoring
------+CA-01 [P] Policy and Procedures
------+CA-02 [P] Control Assessments
------+CA-05 [P] Plan of Action and Milestones
------+CA-06 [P] Authorization
------+CA-07 [P] Continuous Monitoring
---------+CA-07(04) [P] Risk Monitoring
---+CM [P] Configuration Management
------+CM-01 [P] Policy and Procedures
------+CM-04 [P] Impact Analyses
---+IR [P] Incident Response
------+IR-01 [P] Policy and Procedures
------+IR-02 [P] Incident Response Training
---------+IR-02(03) [P] Breach
------+IR-03 [P] Incident Response Testing
------+IR-04 [P] Incident Handling
------+IR-05 [P] Incident Monitoring
------+IR-06 [P] Incident Reporting
------+IR-07 [P] Incident Response Assistance
------+IR-08 [P] Incident Response Plan
---------+IR-08(01) [P] Breaches
---+MP [P] Media Protection
------+MP-01 [P] Policy and Procedures
------+MP-06 [P] Media Sanitization
---+PE [P] Physical and Environmental Protection
------+PE-08(03) [P] Limit Personally Identifiable Information Elements
---+PL [P] Planning
------+PL-01 [P] Policy and Procedures
------+PL-02 [P] System Security and Privacy Plans
------+PL-04 [P] Rules of Behavior
---------+PL-04(01) [P] Social Media and External Site/Application Usage Restrictions
------+PL-08 [P] Security and Privacy Architectures
------+PL-09 [P] Central Management
---+PM [P] Program Management
------+PM-03 [P] Information Security and Privacy Resources
------+PM-04 [P] Plan of Action and Milestones Process
------+PM-05(01) [P] Inventory of Personally Identifiable Information
------+PM-06 [P] Measures of Performance
------+PM-07 [P] Enterprise Architecture
------+PM-08 [P] Critical Infrastructure Plan
------+PM-09 [P] Risk Management Strategy
------+PM-10 [P] Authorization Process
------+PM-11 [P] Mission and Business Process Definition
------+PM-13 [P] Security and Privacy Workforce
------+PM-14 [P] Testing, Training, and Monitoring
------+PM-17 [P] Protecting Controlled Unclassified Information on External Systems
------+PM-18 [P] Privacy Program Plan
------+PM-19 [P] Privacy Program Leadership Role
------+PM-20 [P] Dissemination of Privacy Program Information
---------+PM-20(01) [P] Privacy Policies on Websites, Applications, and Digital Services
------+PM-21 [P] Accounting of Disclosures
------+PM-22 [P] Personally Identifiable Information Quality Management
------+PM-24 [P] Data Integrity Board
------+PM-25 [P] Minimization of Personally Identifiable Information Used in Testing, Training, and Research
------+PM-26 [P] Complaint Management
------+PM-27 [P] Privacy Reporting
------+PM-28 [P] Risk Framing
------+PM-31 [P] Continuous Monitoring Strategy
---+PS [P] Personnel Security
------+PS-06 [P] Access Agreements
---+PT [P] Personally Identifiable Information Processing and Transparency
------+PT-01 [P] Policy and Procedures
------+PT-02 [P] Authority to Process Personally Identifiable Information
------+PT-03 [P] Personally Identifiable Information Processing Purposes
------+PT-04 [P] Consent
------+PT-05 [P] Privacy Notice
---------+PT-05(02) [P] Privacy Act Statements
------+PT-06 [P] System of Records Notice
---------+PT-06(01) [P] Routine Uses
---------+PT-06(02) [P] Exemption Rules
------+PT-07 [P] Specific Categories of Personally Identifiable Information
---------+PT-07(01) [P] Social Security Numbers
---------+PT-07(02) [P] First Amendment Information
------+PT-08 [P] Computer Matching Requirements
---+RA [P] Risk Assessment
------+RA-01 [P] Policy and Procedures
------+RA-03 [P] Risk Assessment
------+RA-07 [P] Risk Response
------+RA-08 [P] Privacy Impact Assessments
---+SA [P] System and Services Acquisition
------+SA-01 [P] Policy and Procedures
------+SA-02 [P] Allocation of Resources
------+SA-03 [P] System Development Life Cycle
------+SA-04 [P] Acquisition Process
------+SA-08(33) [P] Minimization
------+SA-09 [P] External System Services
------+SA-11 [P] Developer Testing and Evaluation
---+SC [P] System and Communications Protection
------+SC-07(24) [P] Personally Identifiable Information
---+SI [P] System and Information Integrity
------+SI-01 [P] Policy and Procedures
------+SI-12 [P] Information Management and Retention
---------+SI-12(01) [P] Limit Personally Identifiable Information Elements
---------+SI-12(02) [P] Minimize Personally Identifiable Information in Testing, Training, and Research
---------+SI-12(03) [P] Information Disposal
------+SI-18 [P] Personally Identifiable Information Quality Operations
---------+SI-18(04) [P] Individual Requests
------+SI-19 [P] De-identification
---+NIST SP 800-53 Rev. 5 PRIVACY Baseline – Assessment Procedures
------+AC-01 [P] Policy and Procedures – Assessment Procedure
------+AC-03(14) [P] Individual Access – Assessment Procedure
------+AT-01 [P] Policy and Procedures – Assessment Procedure
------+AT-02 [P] Literacy Training and Awareness – Assessment Procedure
------+AT-03 [P] Role-based Training – Assessment Procedure
------+AT-03(05) [P] Processing Personally Identifiable Information – Assessment Procedure
------+AT-04 [P] Training Records – Assessment Procedure
------+AU-01 [P] Policy and Procedures – Assessment Procedure
------+AU-02 [P] Event Logging – Assessment Procedure
------+AU-03(03) [P] Limit Personally Identifiable Information Elements – Assessment Procedure
------+AU-11 [P] Audit Record Retention – Assessment Procedure
------+CA-01 [P] Policy and Procedures – Assessment Procedure
------+CA-02 [P] Control Assessments – Assessment Procedure
------+CA-05 [P] Plan of Action and Milestones – Assessment Procedure
------+CA-06 [P] Authorization – Assessment Procedure
------+CA-07 [P] Continuous Monitoring – Assessment Procedure
------+CA-07(04) [P] Risk Monitoring – Assessment Procedure
------+CM-01 [P] Policy and Procedures – Assessment Procedure
------+CM-04 [P] Impact Analyses – Assessment Procedure
------+IR-01 [P] Policy and Procedures – Assessment Procedure
------+IR-02 [P] Incident Response Training – Assessment Procedure
------+IR-02(03) [P] Breach – Assessment Procedure
------+IR-03 [P] Incident Response Testing – Assessment Procedure
------+IR-04 [P] Incident Handling – Assessment Procedure
------+IR-05 [P] Incident Monitoring – Assessment Procedure
------+IR-06 [P] Incident Reporting – Assessment Procedure
------+IR-07 [P] Incident Response Assistance – Assessment Procedure
------+IR-08 [P] Incident Response Plan – Assessment Procedure
------+IR-08(01) [P] Breaches – Assessment Procedure
------+MP-01 [P] Policy and Procedures – Assessment Procedure
------+MP-06 [P] Media Sanitization – Assessment Procedure
------+PE-08(03) [P] Limit Personally Identifiable Information Elements – Assessment Procedure
------+PL-01 [P] Policy and Procedures – Assessment Procedure
------+PL-02 [P] System Security and Privacy Plans – Assessment Procedure
------+PL-04 [P] Rules of Behavior – Assessment Procedure
------+PL-04(01) [P] Social Media and External Site/Application Usage Restrictions – Assessment Procedure
------+PL-08 [P] Security and Privacy Architectures – Assessment Procedure
------+PL-09 [P] Central Management – Assessment Procedure
------+PM-03 [P] Information Security and Privacy Resources – Assessment Procedure
------+PM-04 [P] Plan of Action and Milestones Process – Assessment Procedure
------+PM-05(01) [P] Inventory of Personally Identifiable Information – Assessment Procedure
------+PM-06 [P] Measures of Performance – Assessment Procedure
------+PM-07 [P] Enterprise Architecture – Assessment Procedure
------+PM-08 [P] Critical Infrastructure Plan – Assessment Procedure
------+PM-09 [P] Risk Management Strategy – Assessment Procedure
------+PM-10 [P] Authorization Process – Assessment Procedure
------+PM-11 [P] Mission and Business Process Definition – Assessment Procedure
------+PM-13 [P] Security and Privacy Workforce – Assessment Procedure
------+PM-14 [P] Testing, Training, and Monitoring – Assessment Procedure
------+PM-17 [P] Protecting Controlled Unclassified Information on External Systems – Assessment Procedure
------+PM-18 [P] Privacy Program Plan – Assessment Procedure
------+PM-19 [P] Privacy Program Leadership Role – Assessment Procedure
------+PM-20 [P] Dissemination of Privacy Program Information – Assessment Procedure
------+PM-20(01) [P] Privacy Policies on Websites, Applications, and Digital Services – Assessment Procedure
------+PM-21 [P] Accounting of Disclosures – Assessment Procedure
------+PM-22 [P] Personally Identifiable Information Quality Management – Assessment Procedure
------+PM-24 [P] Data Integrity Board – Assessment Procedure
------+PM-25 [P] Minimization of Personally Identifiable Information Used in Testing, Training, and Research – Assessment Procedure
------+PM-26 [P] Complaint Management – Assessment Procedure
------+PM-27 [P] Privacy Reporting – Assessment Procedure
------+PM-28 [P] Risk Framing – Assessment Procedure
------+PM-31 [P] Continuous Monitoring Strategy – Assessment Procedure
------+PS-06 [P] Access Agreements – Assessment Procedure
------+PT-01 [P] Policy and Procedures – Assessment Procedure
------+PT-02 [P] Authority to Process Personally Identifiable Information – Assessment Procedure
------+PT-03 [P] Personally Identifiable Information Processing Purposes – Assessment Procedure
------+PT-04 [P] Consent – Assessment Procedure
------+PT-05 [P] Privacy Notice – Assessment Procedure
------+PT-05(02) [P] Privacy Act Statements – Assessment Procedure
------+PT-06 [P] System of Records Notice – Assessment Procedure
------+PT-06(01) [P] Routine Uses – Assessment Procedure
------+PT-06(02) [P] Exemption Rules – Assessment Procedure
------+PT-07 [P] Specific Categories of Personally Identifiable Information – Assessment Procedure
------+PT-07(01) [P] Social Security Numbers – Assessment Procedure
------+PT-07(02) [P] First Amendment Information – Assessment Procedure
------+PT-08 [P] Computer Matching Requirements – Assessment Procedure
------+RA-01 [P] Policy and Procedures – Assessment Procedure
------+RA-03 [P] Risk Assessment – Assessment Procedure
------+RA-07 [P] Risk Response – Assessment Procedure
------+RA-08 [P] Privacy Impact Assessments – Assessment Procedure
------+SA-01 [P] Policy and Procedures – Assessment Procedure
------+SA-02 [P] Allocation of Resources – Assessment Procedure
------+SA-03 [P] System Development Life Cycle – Assessment Procedure
------+SA-04 [P] Acquisition Process – Assessment Procedure
------+SA-08(33) [P] Minimization – Assessment Procedure
------+SA-09 [P] External System Services – Assessment Procedure
------+SA-11 [P] Developer Testing and Evaluation – Assessment Procedure
------+SC-07(24) [P] Personally Identifiable Information – Assessment Procedure
------+SI-01 [P] Policy and Procedures – Assessment Procedure
------+SI-12 [P] Information Management and Retention – Assessment Procedure
------+SI-12(01) [P] Limit Personally Identifiable Information Elements – Assessment Procedure
------+SI-12(02) [P] Minimize Personally Identifiable Information in Testing, Training, and Research – Assessment Procedure
------+SI-12(03) [P] Information Disposal – Assessment Procedure
------+SI-18 [P] Personally Identifiable Information Quality Operations – Assessment Procedure
------+SI-18(04) [P] Individual Requests – Assessment Procedure
------+SI-19 [P] De-identification – Assessment Procedure

Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.2.0 PRIVACY BASELINE

Electronic (OSCAL) Version of NIST Special Publication 800-53 Revision 5.2.0 PRIVACY BASELINE

1. Übersicht

AC [P] Access Control Access Control
AT [P] Awareness and Training Awareness and Training
AU [P] Audit and Accountability Audit and Accountability
CA [P] Assessment, Authorization, and Monitoring Assessment, Authorization, and Monitoring
CM [P] Configuration Management Configuration Management
IR [P] Incident Response Incident Response
MP [P] Media Protection Media Protection
PE [P] Physical and Environmental Protection Physical and Environmental Protection
PL [P] Planning Planning
PM [P] Program Management Program Management
PS [P] Personnel Security Personnel Security
PT [P] Personally Identifiable Information Processing and Transparency Personally Identifiable Information Processing and Transparency
RA [P] Risk Assessment Risk Assessment
SA [P] System and Services Acquisition System and Services Acquisition
SC [P] System and Communications Protection System and Communications Protection
SI [P] System and Information Integrity System and Information Integrity

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
is related to English
includes NIST SP 800-53 Rev. 5 PRIVACY Baseline – Assessment Procedures