Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- PRI-29.3_A01 elements of Personal Data (PD) being processed in the information life cycle are defined.
Assessment rigor: 1
Origin: 53A_R5_SI-12(01)_ODP - PRI-29.3_A02 techniques used to minimize the use of Personal Data (PD) for research, testing and training are defined.
Assessment rigor: 1
Origin: 53A_R5_SI-12(02)_ODP[01] 53A_R5_SI-12(02)_ODP[02] 53A_R5_SI-12(02)_ODP[03] - PRI-29.3_A03 organization-defined techniques are used to minimize the use of Personal Data (PD) for research, testing and training.
Assessment rigor: 1
Origin: 53A_R5_SI-12(02)[01] 53A_R5_SI-12(02)[02] 53A_R5_SI-12(02)[03] - PRI-29.3_A04 Personal Data (PD) being processed in the information life cycle is limited to organization-defined elements of Personal Data (PD).
Assessment rigor: 3
Origin: 53A_R5_SI-12(01) - PRI-29.3_A05 the frequency for reviewing policies that address the use of Personal Data (PD) for internal testing, training and research is defined.
Defined parameters: at least annually
Assessment rigor: 3
Origin: 53A_R5_PM-25_ODP[01] - PRI-29.3_A06 the frequency for updating policies that address the use of Personal Data (PD) for internal testing, training and research is defined.
Defined parameters: at least annually
Assessment rigor: 3
Origin: 53A_R5_PM-25_ODP[02] - PRI-29.3_A07 the frequency for reviewing procedures that address the use of Personal Data (PD) for internal testing, training and research is defined.
Defined parameters: at least annually
Assessment rigor: 3
Origin: 53A_R5_PM-25_ODP[03] - PRI-29.3_A08 the frequency for updating procedures that address the use of Personal Data (PD) for internal testing, training and research is defined.
Defined parameters: at least annually
Assessment rigor: 3
Origin: 53A_R5_PM-25_ODP[04] - PRI-29.3_A09 policies that address the use of Personal Data (PD) for internal research, testing and training are developed and documented.
Assessment rigor: 3
Origin: 53A_R5_PM-25a.[01] 53A_R5_PM-25a.[02] 53A_R5_PM-25a.[03] - PRI-29.3_A10 procedures that address the use of Personal Data (PD) for internal research, testing and training are developed and documented.
Assessment rigor: 3
Origin: 53A_R5_PM-25a.[04] 53A_R5_PM-25a.[05] 53A_R5_PM-25a.[06] - PRI-29.3_A11 policies that address the use of Personal Data (PD) for internal research, testing and training are implemented.
Assessment rigor: 3
Origin: 53A_R5_PM-25a.[07] 53A_R5_PM-25a.[08] 53A_R5_PM-25a.[09] - PRI-29.3_A12 procedures that address the use of Personal Data (PD) for internal research, testing and training are implemented.
Assessment rigor: 3
Origin: 53A_R5_PM-25a.[10] 53A_R5_PM-25a.[11] 53A_R5_PM-25a.[12] - PRI-29.3_A13 the amount of Personal Data (PD) used for internal research, testing and training purposes is limited or minimized.
Assessment rigor: 3
Origin: 53A_R5_PM-25b.[01] 53A_R5_PM-25b.[02] 53A_R5_PM-25b.[03] - PRI-29.3_A14 the required use of Personal Data (PD) for internal research, testing and training is authorized.
Assessment rigor: 3
Origin: 53A_R5_PM-25c.[01] 53A_R5_PM-25c.[02] 53A_R5_PM-25c.[03] - PRI-29.3_A15 policies are reviewed frequently.
Assessment rigor: 3
Origin: 53A_R5_PM-25d.[01] - PRI-29.3_A16 policies are updated frequently.
Assessment rigor: 3
Origin: 53A_R5_PM-25d.[02] - PRI-29.3_A17 procedures are reviewed frequently.
Assessment rigor: 3
Origin: 53A_R5_PM-25d.[03] - PRI-29.3_A18 procedures are updated frequently.
Assessment rigor: 3
Origin: 53A_R5_PM-25d.[04] - PRI-29.3_A19 the authority to permit the processing of Personal Data (PD) is defined.
Assessment rigor: 3
Origin: 53A_R5_PT-02_ODP[01] - PRI-29.3_A20 the type of processing of Personal Data (PD) is defined.
Assessment rigor: 3
Origin: 53A_R5_PT-02_ODP[02] - PRI-29.3_A21 the type of processing of Personal Data (PD) to be restricted is defined.
Assessment rigor: 3
Origin: 53A_R5_PT-02_ODP[03] - PRI-29.3_A22 the authority that permits the processing of Personal Data (PD) is determined and documented.
Assessment rigor: 3
Origin: 53A_R5_PT-02a. - PRI-29.3_A23 the processing of Personal Data (PD) is restricted to only that which is authorized.
Assessment rigor: 3
Origin: 53A_R5_PT-02b. - PRI-29.3_A24 the purpose(s) for processing Personal Data (PD) is/are defined.
Assessment rigor: 3
Origin: 53A_R5_PT-03_ODP[01] - PRI-29.3_A25 the processing of Personal Data (PD) to be restricted is defined.
Assessment rigor: 3
Origin: 53A_R5_PT-03_ODP[02] - PRI-29.3_A26 mechanisms to be implemented for ensuring any changes in the processing of Personal Data (PD) are made in accordance with requirements are defined.
Assessment rigor: 3
Origin: 53A_R5_PT-03_ODP[03] - PRI-29.3_A27 requirements for changing the processing of Personal Data (PD) are defined.
Assessment rigor: 3
Origin: 53A_R5_PT-03_ODP[04] - PRI-29.3_A28 the purpose(s) for processing Personal Data (PD) is/are identified and documented.
Assessment rigor: 3
Origin: 53A_R5_PT-03a. - PRI-29.3_A29 the purpose(s) is/are described in the public privacy notices of the organization.
Assessment rigor: 3
Origin: 53A_R5_PT-03b.[01] - PRI-29.3_A30 the purpose(s) is/are described in the policies of the organization.
Assessment rigor: 3
Origin: 53A_R5_PT-03b.[02] - PRI-29.3_A31 the processing of Personal Data (PD) is restricted to only that which is compatible with the identified purpose(s).
Assessment rigor: 3
Origin: 53A_R5_PT-03c. - PRI-29.3_A32 changes in the processing of Personal Data (PD) are monitored.
Assessment rigor: 3
Origin: 53A_R5_PT-03d.[01] - PRI-29.3_A33 mechanisms are implemented to ensure that any changes are made in accordance with requirements.
Assessment rigor: 3
Origin: 53A_R5_PT-03d.[02]
Συνδεδεμένα ζητήματα
| Τύπος σύνδεσης | Ζήτημα |
|---|---|
| blocks | Internal Use of Personal Data (PD) For Testing, Training and Research |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.