Assessment Objective
Determine if:
- PM-05(01)[01] an inventory of all systems, applications, and projects that process personally identifiable information is established;
- PM-05(01)[02] an inventory of all systems, applications, and projects that process personally identifiable information is maintained;
- PM-05(01)[03] an inventory of all systems, applications, and projects that process personally identifiable information is updated [Assignment: frequency].
Assessment Methods
Examine
- Procedures addressing system inventory development, maintenance, and updates
- OMB FISMA reporting guidance
- privacy program plan
- information security program plan
- personally identifiable information processing policy
- system inventory
- personally identifiable information inventory
- data mapping documentation
- other relevant documents or records
Interview
- Organizational personnel with privacy program planning and plan implementation responsibilities
- organizational personnel responsible for developing and maintaining the system inventory
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for system inventory development, maintenance, and updates
- mechanisms supporting the system inventory
Συνδεδεμένα ζητήματα
| Τύπος σύνδεσης | Ζήτημα |
|---|---|
| blocks | PM-05(01) [P] Inventory of Personally Identifiable Information |