+SI [P] System and Information Integrity
---+SI-01 [P] Policy and Procedures
---+SI-12 [P] Information Management and Retention
------+SI-12(01) [P] Limit Personally Identifiable Information Elements
------+SI-12(02) [P] Minimize Personally Identifiable Information in Testing, Training, and Research
------+SI-12(03) [P] Information Disposal
---+SI-18 [P] Personally Identifiable Information Quality Operations
------+SI-18(04) [P] Individual Requests
---+SI-19 [P] De-identification

SI [P] System and Information Integrity

System and Information Integrity

1. Übersicht

SI-01 [P] Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the system and information integrity policy and procedures; and
  3. Review and update the current system and information integrity:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

System and information integrity policy and procedures address the controls in the SI family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of system and information integrity policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to system and information integrity policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. a system and information integrity policy is developed and documented;
    2. the system and information integrity policy is disseminated to [Assignement: personnel or roles];
    3. system and information integrity procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls are developed and documented;
    4. the system and information integrity procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] system and information integrity policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures;
      1. the current system and information integrity policy is reviewed and updated [Assignement: frequency];
      2. the current system and information integrity policy is reviewed and updated following [Assignement: events];
      1. the current system and information integrity procedures are reviewed and updated [Assignement: frequency];
      2. the current system and information integrity procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

System and information integrity policy system and information integrity procedures system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with system and information integrity responsibilities organizational personnel with information security and privacy responsibilities
SI-12 [P] Information Management and Retention

Control

Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.

Discussion

Information management and retention requirements cover the full life cycle of information, in some cases extending beyond system disposal. Information to be retained may also include policies, procedures, plans, reports, data output from control implementation, and other types of administrative information. The National Archives and Records Administration (NARA) provides federal policy and guidance on records retention and schedules. If organizations have a records management office, consider coordinating with records management personnel. Records produced from the output of implemented controls that may require management and retention include, but are not limited to: All XX-1, [AC-6(9)](#ac-6.9), [AT-4](#at-4), [AU-12](#au-12), [CA-2](#ca-2), [CA-3](#ca-3), [CA-5](#ca-5), [CA-6](#ca-6), [CA-7](#ca-7), [CA-8](#ca-8), [CA-9](#ca-9), [CM-2](#cm-2), [CM-3](#cm-3), [CM-4](#cm-4), [CM-6](#cm-6), [CM-8](#cm-8), [CM-9](#cm-9), [CM-12](#cm-12), [CM-13](#cm-13), [CP-2](#cp-2), [IR-6](#ir-6), [IR-8](#ir-8), [MA-2](#ma-2), [MA-4](#ma-4), [PE-2](#pe-2), [PE-8](#pe-8), [PE-16](#pe-16), [PE-17](#pe-17), [PL-2](#pl-2), [PL-4](#pl-4), [PL-7](#pl-7), [PL-8](#pl-8), [PM-5](#pm-5), [PM-8](#pm-8), [PM-9](#pm-9), [PM-18](#pm-18), [PM-21](#pm-21), [PM-27](#pm-27), [PM-28](#pm-28), [PM-30](#pm-30), [PM-31](#pm-31), [PS-2](#ps-2), [PS-6](#ps-6), [PS-7](#ps-7), [PT-2](#pt-2), [PT-3](#pt-3), [PT-7](#pt-7), [RA-2](#ra-2), [RA-3](#ra-3), [RA-5](#ra-5), [RA-8](#ra-8), [SA-4](#sa-4), [SA-5](#sa-5), [SA-8](#sa-8), [SA-10](#sa-10), [SI-4](#si-4), [SR-2](#sr-2), [SR-4](#sr-4), [SR-8](#sr-8).

Assessment Objective

  1. information within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
  2. information within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
  3. information output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
  4. information output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures personally identifiable information processing policy records retention and disposition policy records retention and disposition procedures federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information management and retention media protection policy media protection procedures audit findings system security plan privacy plan privacy program plan personally identifiable information inventory privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel with information and records management, retention, and disposition responsibilities organizational personnel with information security and privacy responsibilities network administrators
SI-18 [P] Personally Identifiable Information Quality Operations

Control

  1. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [Assignement: organization-defined frequency] ; and
  2. Correct or delete inaccurate or outdated personally identifiable information.

Discussion

Personally identifiable information quality operations include the steps that organizations take to confirm the accuracy and relevance of personally identifiable information throughout the information life cycle. The information life cycle includes the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of personally identifiable information. Personally identifiable information quality operations include editing and validating addresses as they are collected or entered into systems using automated address verification look-up application programming interfaces. Checking personally identifiable information quality includes the tracking of updates or changes to data over time, which enables organizations to know how and what personally identifiable information was changed should erroneous information be identified. The measures taken to protect personally identifiable information quality are based on the nature and context of the personally identifiable information, how it is to be used, how it was obtained, and the potential de-identification methods employed. The measures taken to validate the accuracy of personally identifiable information used to make determinations about the rights, benefits, or privileges of individuals covered under federal programs may be more comprehensive than the measures used to validate personally identifiable information used for less sensitive purposes.

Assessment Objective

    1. the accuracy of personally identifiable information across the information life cycle is checked [Assignement: frequency];
    2. the relevance of personally identifiable information across the information life cycle is checked [Assignement: frequency];
    3. the timeliness of personally identifiable information across the information life cycle is checked [Assignement: frequency];
    4. the completeness of personally identifiable information across the information life cycle is checked [Assignement: frequency];
  2. inaccurate or outdated personally identifiable information is corrected or deleted.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures personally identifiable information processing policy documentation addressing personally identifiable information quality operations quality reports maintenance logs system audit records audit findings system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel responsible for performing personally identifiable information quality inspections organizational personnel with information security responsibilities organizational personnel with privacy responsibilities
SI-19 [P] De-identification

Control

  1. Remove the following elements of personally identifiable information from datasets: [Assignement: elements] ; and
  2. Evaluate [Assignement: frequency] for effectiveness of de-identification.

Discussion

De-identification is the general term for the process of removing the association between a set of identifying data and the data subject. Many datasets contain information about individuals that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records. Datasets may also contain other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. Personally identifiable information is removed from datasets by trained individuals when such information is not (or no longer) necessary to satisfy the requirements envisioned for the data. For example, if the dataset is only used to produce aggregate statistics, the identifiers that are not needed for producing those statistics are removed. Removing identifiers improves privacy protection since information that is removed cannot be inadvertently disclosed or improperly used. Organizations may be subject to specific de-identification definitions or methods under applicable laws, regulations, or policies. Re-identification is a residual risk with de-identified data. Re-identification attacks can vary, including combining new datasets or other improvements in data analytics. Maintaining awareness of potential attacks and evaluating for the effectiveness of the de-identification over time support the management of this residual risk.

Assessment Objective

  1. [Assignement: elements] are removed from datasets;
  2. the effectiveness of de-identification is evaluated [Assignement: frequency].

Assessment Method

Examine

System and information integrity policy system and information integrity procedures personally identifiable information processing policy de-identification procedures system configuration datasets with personally identifiable information removed system security plan privacy plan privacy impact assessment privacy risk assessment documentation other relevant documents or records

Interview

Organizational personnel responsible for identifying unnecessary identifiers organizational personnel responsible for removing personally identifiable information from datasets organizational personnel with information security and privacy responsibilities

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen