Assessment Objective
Determine if:
- PT-03a. the [Assignment: purpose(s)] for processing personally identifiable information is/are identified and documented;
- PT-03b.
- PT-03b.[01] the purpose(s) is/are described in the public privacy notices of the organization;
- PT-03b.[02] the purpose(s) is/are described in the policies of the organization;
- PT-03c. the [Assignment: processing] of personally identifiable information are restricted to only that which is compatible with the identified purpose(s);
- PT-03d.
- PT-03d.[01] changes in the processing of personally identifiable information are monitored;
- PT-03d.[02] [Assignment: mechanisms] are implemented to ensure that any changes are made in accordance with [Assignment: requirements].
Assessment Methods
Examine
- Personally identifiable information processing and transparency policy and procedures
- configuration management plan
- organizational privacy notices
- organizational policies
- Privacy Act statements
- computer matching notices
- applicable Federal Register notices
- documented requirements for enforcing and monitoring the processing of personally identifiable information
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for authorizing the processing of personally identifiable information
- mechanisms supporting and/or implementing the management of authorized personally identifiable information processing
- organizational processes for monitoring changes in processing personally identifiable information
Susietos užduotys
| Saito tipas | Užduotis |
|---|---|
| blocks | PT-03 Personally Identifiable Information Processing Purposes |