Lexim011/Compliance huggingface dataset:
CCI-003567 (policy): The organization provides effective notice to individuals regarding the ability to have personally identifiable information (PII) amended or corrected if necessary.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a
CCI-003568 (policy): The organization describes the personally identifiable information (PII) the organization collects.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b
CCI-003569 (policy): The organization describes the purpose(s) for which it collects the personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b
CCI-003570 (policy): The organization describes how the organization uses personally identifiable information (PII) internally.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b
CCI-003571 (policy): The organization describes whether the organization shares personally identifiable information (PII) with external entities.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b
CCI-003572 (policy): The organization describes the categories of those external entities with whom personally identifiable information (PII) is shared.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b
CCI-003573 (policy): The organization describes the purposes for sharing personally identifiable information (PII) with external entities.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b
CCI-003574 (policy): The organization describes whether individuals have the ability to consent to specific uses or sharing of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b
CCI-003575 (policy): The organization describes how individuals may exercise their consent regarding specific uses or sharing of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b
CCI-003576 (policy): The organization describes how individuals may obtain access to personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b
CCI-003577 (policy): The organization describes how the personally identifiable information (PII) will be protected.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 b
CCI-003578 (policy): The organization revises its public notices to reflect changes in practice or policy that affect personally identifiable information (PII), before or as soon as practicable after the change.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 c
CCI-003579 (policy): The organization revises its public notices to reflect changes in practice or policy that impact privacy, before or as soon as practicable after the change.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 c
CCI-003580 (policy): The organization provides real-time notice and/or layered notice when it collects personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 (1)
CCI-003581 (policy): The organization publishes System of Records Notices (SORNs) in the Federal Register, subject to required oversight processes, for systems containing personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-2 a
CCI-003582 (policy): The organization keeps System of Records Notices (SORNs) current.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-2 b
CCI-003583 (policy): The organization includes Privacy Act Statements on its forms that collect personally identifiable information (PII), or on separate forms that can be retained by individuals, to provide additional formal notice to individuals from whom the information is being collected.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-2 c
CCI-003584 (policy): The organization publishes System of Records Notices (SORNs) on its public website.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-2 (1)
CCI-003585 (policy): The organization ensures the public has access to information about its privacy activities.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-3 a
CCI-003586 (policy): The organization ensures the public is able to communicate with its Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-3 a
CCI-003587 (policy): The organization ensures its privacy practices are publicly available through organizational websites or otherwise.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-3 b
CCI-003588 (policy): The organization uses personally identifiable information (PII) internally only for the authorized purpose(s) identified in the Privacy Act and/or in public notices.
References: NIST: NIST SP 800-53 Revision 4 (v4): UL-1
CCI-003589 (policy): The organization shares personally identifiable information (PII) externally, only for the authorized purposes identified in the Privacy Act and/or described in its notice(s) or for a purpose that is compatible with those purposes.
References: NIST: NIST SP 800-53 Revision 4 (v4): UL-2 a
CCI-003590 (policy): The organization, where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically describe the personally identifiable information (PII) covered.
References: NIST: NIST SP 800-53 Revision 4 (v4): UL-2 b
CCI-003591 (policy): The organization, where appropriate, enters into Memoranda of Understanding, Memoranda of Agreement, Letters of Intent, Computer Matching Agreements, or similar agreements, with third parties that specifically enumerate the purposes for which the personally identifiable information (PII) may be used.
References: NIST: NIST SP 800-53 Revision 4 (v4): UL-2 b
CCI-003592 (policy): The organization monitors its staff on the authorized sharing of personally identifiable information (PII) with third parties.
References: NIST: NIST SP 800-53 Revision 4 (v4): UL-2 c
CCI-003593 (policy): The organization audits its staff on the authorized sharing of personally identifiable information (PII) with third parties.
References: NIST: NIST SP 800-53 Revision 4 (v4): UL-2 c
CCI-003594 (policy): The organization trains its staff on the authorized sharing of personally identifiable information (PII) with third parties.
References: NIST: NIST SP 800-53 Revision 4 (v4): UL-2 c
CCI-003595 (policy): The organization trains its staff on the consequences of unauthorized use or sharing of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): UL-2 c
CCI-003596 (policy): The organization evaluates any proposed new instances of sharing personally identifiable information (PII) with third parties to assess whether the sharing is authorized.
References: NIST: NIST SP 800-53 Revision 4 (v4): UL-2 d
CCI-003597 (policy): The organization evaluates any proposed new instances of sharing personally identifiable information (PII) with third parties to assess whether additional or new public notice is required.
References: NIST: NIST SP 800-53 Revision 4 (v4): UL-2 d
CCI-003599 (policy): The organization defines the individuals or information systems to be the only recipients of organization-defined information, information system components, or devices, by employing organization-defined security safeguards.
References: NIST: NIST SP 800-53 Revision 4 (v4): SC-37 (1)