Assessment Objective
Determine if:
- PM-22[01] organization-wide policies for personally identifiable information quality management are developed and documented;
- PM-22[02] organization-wide procedures for personally identifiable information quality management are developed and documented;
- PM-22a.
- PM-22a.[01] the policies address reviewing the accuracy of personally identifiable information across the information life cycle;
- PM-22a.[02] the policies address reviewing the relevance of personally identifiable information across the information life cycle;
- PM-22a.[03] the policies address reviewing the timeliness of personally identifiable information across the information life cycle;
- PM-22a.[04] the policies address reviewing the completeness of personally identifiable information across the information life cycle;
- PM-22a.[05] the procedures address reviewing the accuracy of personally identifiable information across the information life cycle;
- PM-22a.[06] the procedures address reviewing the relevance of personally identifiable information across the information life cycle;
- PM-22a.[07] the procedures address reviewing the timeliness of personally identifiable information across the information life cycle;
- PM-22a.[08] the procedures address reviewing the completeness of personally identifiable information across the information life cycle;
- PM-22b.
- PM-22b.[01] the policies address correcting or deleting inaccurate or outdated personally identifiable information;
- PM-22b.[02] the procedures address correcting or deleting inaccurate or outdated personally identifiable information;
- PM-22c.
- PM-22c.[01] the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
- PM-22c.[02] the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
- PM-22d.
- PM-22d.[01] the policies address appeals of adverse decisions on correction or deletion requests;
- PM-22d.[02] the procedures address appeals of adverse decisions on correction or deletion requests.
Assessment Methods
Examine
- Privacy program plan
- policies and procedures addressing personally identifiable information quality management, information life cycle documentation, and sample notices of correction or deletion
- records of monitoring PII quality management practices
- documentation of reviews and updates of policies and procedures
Interview
- Organizational personnel with privacy program information dissemination responsibilities
- organizational personnel with privacy responsibilities
Test
- [Organizational processes for data quality and personally identifiable information quality management procedures
- mechanisms supporting and/or implementing quality management requirements
Ticket collegati
| Tipo di collegamento | Ticket |
|---|---|
| blocks | PM-22 [P] Personally Identifiable Information Quality Management |