+SA-08(33) Minimization
|
SA-08(33) Minimization
Control
Implement the privacy principle of minimization using [Assignement: processes].
Discussion
The principle of minimization states that organizations should only process personally identifiable information that is directly relevant and necessary to accomplish an authorized purpose and should only maintain personally identifiable information for as long as is necessary to accomplish the purpose. Organizations have processes in place, consistent with applicable laws and policies, to implement the principle of minimization.
Assessment Objective
the privacy principle of minimization is implemented using [Assignement: processes].
Assessment Method
Examine
System and services acquisition policy
system and services acquisition procedures
personally identifiable information processing policy
procedures addressing the minimization of personally identifiable information in system design
system design documentation
system configuration settings and associated documentation
change control records
information security and privacy requirements and specifications for the system
system security and privacy architecture
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel with information security and privacy responsibilities
organizational personnel with system specification, design, development, implementation, and modification responsibilities
system developers
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|