Assessment Objective

Determine if:

• PE-08(03) personally identifiable information contained in visitor access records is limited to [Assignment: elements] identified in the privacy risk assessment.

Assessment Methods

Examine

• Physical and environmental protection policy
• personally identifiable information processing policy
• privacy risk assessment documentation
• privacy impact assessment
• visitor access records
• personally identifiable information inventory
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with visitor access records responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for maintaining and reviewing visitor access records

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final