Assessment Objective

Determine if:

• SI-19(07)[01] de-identification is performed using validated algorithms;
• SI-19(07)[02] de-identification is performed using software that is validated to implement the algorithms.

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• personally identifiable information processing policy
• de-identification procedures
• system configuration
• de-identified datasets
• algorithm and software validation tools
• system security plan
• privacy plan
• privacy impact assessment
• privacy risk assessment documentation
• other relevant documents or records

Interview

• Organizational personnel responsible for de-identifying the dataset
• organizational personnel with information security and privacy responsibilities

Test

• Validated algorithms and software

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final