Assessment Objective

Determine if:

• PM-25a.
  • PM-25a.[01] policies that address the use of personally identifiable information for internal testing are developed and documented;
  • PM-25a.[02] policies that address the use of personally identifiable information for internal training are developed and documented;
  • PM-25a.[03] policies that address the use of personally identifiable information for internal research are developed and documented;
  • PM-25a.[04] procedures that address the use of personally identifiable information for internal testing are developed and documented;
  • PM-25a.[05] procedures that address the use of personally identifiable information for internal training are developed and documented;
  • PM-25a.[06] procedures that address the use of personally identifiable information for internal research are developed and documented;
  • PM-25a.[07] policies that address the use of personally identifiable information for internal testing, are implemented;
  • PM-25a.[08] policies that address the use of personally identifiable information for training are implemented;
  • PM-25a.[09] policies that address the use of personally identifiable information for research are implemented;
  • PM-25a.[10] procedures that address the use of personally identifiable information for internal testing are implemented;
  • PM-25a.[11] procedures that address the use of personally identifiable information for training are implemented;
  • PM-25a.[12] procedures that address the use of personally identifiable information for research are implemented;
• PM-25b.
  • PM-25b.[01] the amount of personally identifiable information used for internal testing purposes is limited or minimized;
  • PM-25b.[02] the amount of personally identifiable information used for internal training purposes is limited or minimized;
  • PM-25b.[03] the amount of personally identifiable information used for internal research purposes is limited or minimized;
• PM-25c.
  • PM-25c.[01] the required use of personally identifiable information for internal testing is authorized;
  • PM-25c.[02] the required use of personally identifiable information for internal training is authorized;
  • PM-25c.[03] the required use of personally identifiable information for internal research is authorized;
• PM-25d.
  • PM-25d.[01] policies are reviewed [Assignment: frequency];
  • PM-25d.[02] policies are updated [Assignment: frequency];
  • PM-25d.[03] procedures are reviewed [Assignment: frequency];
  • PM-25d.[04] procedures are updated [Assignment: frequency].

Assessment Methods

Examine

• Privacy program plan
• policies and procedures for the minimization of personally identifiable information used in testing, training, and research
• documentation supporting policy implementation (e.g., templates for testing, training, and research
• privacy threshold analysis
• privacy risk assessment)
• data sets used for testing, training, and research

Interview

• Organizational personnel with privacy program responsibilities
• organizational personnel with privacy responsibilities
• system developers
• personnel with IRB responsibilities

Test

• Organizational processes for data quality and personally identifiable information management
• mechanisms supporting data quality management and personally identifiable information management to minimize the use of personally identifiable information

Länkade ärenden

• NIST -

  EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

  DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.