Assessment Objective

Determine if:

• SI-19a. [Assignment: elements] are removed from datasets;
• SI-19b. the effectiveness of de-identification is evaluated [Assignment: frequency].

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• personally identifiable information processing policy
• de-identification procedures
• system configuration
• datasets with personally identifiable information removed
• system security plan
• privacy plan
• privacy impact assessment
• privacy risk assessment documentation
• other relevant documents or records

Interview

• Organizational personnel responsible for identifying unnecessary identifiers
• organizational personnel responsible for removing personally identifiable information from datasets
• organizational personnel with information security and privacy responsibilities

Test

• Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements

Powiązane zgłoszenia

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final