Assessment Objective
Determine if:
- PM-25a.
- PM-25a.[01] policies that address the use of personally identifiable information for internal testing are developed and documented;
- PM-25a.[02] policies that address the use of personally identifiable information for internal training are developed and documented;
- PM-25a.[03] policies that address the use of personally identifiable information for internal research are developed and documented;
- PM-25a.[04] procedures that address the use of personally identifiable information for internal testing are developed and documented;
- PM-25a.[05] procedures that address the use of personally identifiable information for internal training are developed and documented;
- PM-25a.[06] procedures that address the use of personally identifiable information for internal research are developed and documented;
- PM-25a.[07] policies that address the use of personally identifiable information for internal testing, are implemented;
- PM-25a.[08] policies that address the use of personally identifiable information for training are implemented;
- PM-25a.[09] policies that address the use of personally identifiable information for research are implemented;
- PM-25a.[10] procedures that address the use of personally identifiable information for internal testing are implemented;
- PM-25a.[11] procedures that address the use of personally identifiable information for training are implemented;
- PM-25a.[12] procedures that address the use of personally identifiable information for research are implemented;
- PM-25b.
- PM-25b.[01] the amount of personally identifiable information used for internal testing purposes is limited or minimized;
- PM-25b.[02] the amount of personally identifiable information used for internal training purposes is limited or minimized;
- PM-25b.[03] the amount of personally identifiable information used for internal research purposes is limited or minimized;
- PM-25c.
- PM-25c.[01] the required use of personally identifiable information for internal testing is authorized;
- PM-25c.[02] the required use of personally identifiable information for internal training is authorized;
- PM-25c.[03] the required use of personally identifiable information for internal research is authorized;
- PM-25d.
- PM-25d.[01] policies are reviewed [Assignment: frequency];
- PM-25d.[02] policies are updated [Assignment: frequency];
- PM-25d.[03] procedures are reviewed [Assignment: frequency];
- PM-25d.[04] procedures are updated [Assignment: frequency].
Assessment Methods
Examine
- Privacy program plan
- policies and procedures for the minimization of personally identifiable information used in testing, training, and research
- documentation supporting policy implementation (e.g., templates for testing, training, and research
- privacy threshold analysis
- privacy risk assessment)
- data sets used for testing, training, and research
Interview
- Organizational personnel with privacy program responsibilities
- organizational personnel with privacy responsibilities
- system developers
- personnel with IRB responsibilities
Test
- Organizational processes for data quality and personally identifiable information management
- mechanisms supporting data quality management and personally identifiable information management to minimize the use of personally identifiable information
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | PM-25 [P] Minimization of Personally Identifiable Information Used in Testing, Training, and Research |