Assessment Objective
Determine if:
- SI-19(05)[01] numerical data is manipulated so that no individual or organization is identifiable in the results of the analysis;
- SI-19(05)[02] contingency tables are manipulated so that no individual or organization is identifiable in the results of the analysis;
- SI-19(05)[03] statistical findings are manipulated so that no individual or organization is identifiable in the results of the analysis.
Assessment Methods
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- de-identification procedures
- system configuration
- de-identified datasets
- statistical analysis report
- tools for the control of statistical disclosure
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel responsible for de-identifying the dataset
- organizational personnel with information security and privacy responsibilities
Test
- Automated mechanisms supporting and/or implementing the control of statistical disclosure
Ticket collegati
| Tipo di collegamento | Ticket |
|---|---|
| blocks | SI-19(05) Statistical Disclosure Control |