Assessment Objective

Determine if:

• SC-42(05) the [Assignment: sensors] configured to minimize the collection of information about individuals that is not needed are employed.

Assessment Methods

Examine

• System and communications protection policy
• access control policy and procedures
• personally identifiable information processing policy
• sensor capability and data collection policy and procedures
• system design documentation
• system configuration settings and associated documentation
• privacy risk assessment documentation
• privacy impact assessments
• system architecture
• list of information being collected by sensors
• list of sensor configurations that minimize the collection of personally identifiable information (e.g., obscure human features)
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy responsibilities
• organizational personnel installing, configuring, and/or maintaining the system
• organizational personnel responsible for sensor capabilities

Test

• Mechanisms supporting and/or implementing measures to facilitate the review of information that is being collected by sensors
• sensor information collection capabilities for the system

Verknüpfte Vorgänge

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final