Lexim011/Compliance huggingface dataset:
CCI-003352 (policy): The organization inspects organization-defined information systems, system components, or devices at random, at an organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (2)
CCI-003353 (policy): The organization defines the information systems, system components, or devices to inspect at random, at an organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (2)
CCI-003354 (policy): The organization defines the frequency on which to inspect organization-defined information systems, system components, or devices to detect tampering.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (2)
CCI-003355 (policy): The organization defines indications of need for inspection to detect tampering during inspections of organization-defined information systems, system components, or devices.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-18 (2)
CCI-003356 (policy): The organization develops an anti-counterfeit policy that includes the means to detect counterfeit components from entering the information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a
CCI-003357 (policy): The organization develops an anti-counterfeit policy that includes the means to prevent counterfeit components from entering the information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a
CCI-003358 (policy): The organization develops anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a
CCI-003359 (policy): The organization develops anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a
CCI-003360 (policy): The organization implements an anti-counterfeit policy that includes the means to detect counterfeit components from entering the information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a
CCI-003361 (policy): The organization implements an anti-counterfeit policy that includes the means to prevent counterfeit components from entering the information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a
CCI-003362 (policy): The organization implements anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a
CCI-003363 (policy): The organization implements anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 a
CCI-003364 (policy): The organization reports counterfeit information system components to the source of the counterfeit component, organization-defined external reporting organizations, and/or organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 b
CCI-003365 (policy): The organization defines the external reporting organizations to which counterfeit information system components are to be reported.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 b
CCI-003366 (policy): The organization defines the personnel or roles to whom counterfeit information system components are to be reported.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 b
CCI-003367 (policy): The organization trains organization-defined personnel or roles to detect counterfeit information system components (including hardware, software, and firmware).
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (1)
CCI-003368 (policy): The organization defines the personnel or roles to be trained to detect counterfeit information system components (including hardware, software, and firmware).
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (1)
CCI-003369 (policy): The organization maintains configuration control over organization-defined information system components awaiting service/repair.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (2)
CCI-003370 (policy): The organization defines the information system components awaiting service/repair over which configuration control must be maintained.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (2)
CCI-003371 (policy): The organization maintains configuration control over serviced/repaired components awaiting return to service.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (2)
CCI-003374 (policy): The organization documents approval for the continued use of unsupported system components required to satisfy mission/business needs.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-22 b
CCI-003375 (policy): The organization provides justification for the continued use of unsupported system components required to satisfy mission/business needs.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-22 b
CCI-003377 (policy): The organization defines the actions the developer of the information system, system component, or information system service must take to ensure the required screening criteria are satisfied.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-21 (1)
CCI-003378 (policy): The organization defines the actions the developer of the information system, system component, or information system service must take to ensure the required access authorizations are satisfied.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-21 (1)
CCI-003379 (policy): The organization requires the developer of the information system, system component, or information system service take organization-defined actions to ensure the required screening criteria are satisfied.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-21 (1)
CCI-003380 (policy): The organization requires the developer of the information system, system component, or information system service take organization-defined actions to ensure the required access authorizations are satisfied.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-21 (1)
CCI-003388 (policy): The organization defines the frequency on which to scan for counterfeit information system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (4)
CCI-003389 (policy): The organization scans for counterfeit information system components in accordance with organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (4)
CCI-003390 (policy): The organization defines the techniques and methods used to dispose of information system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (3)
CCI-003391 (policy): The organization disposes of information system components using organization-defined techniques and methods.
References: NIST: NIST SP 800-53 Revision 4 (v4): SA-19 (3)
CCI-003392 (policy): The organization determines and documents the legal authority that permits the collection of personally identifiable information (PII), either generally or in support of a specific program or information system need.
References: NIST: NIST SP 800-53 Revision 4 (v4): AP-1
CCI-003393 (policy): The organization determines and documents the legal authority that permits the use of personally identifiable information (PII), either generally or in support of a specific program or information system need.
References: NIST: NIST SP 800-53 Revision 4 (v4): AP-1
CCI-003394 (policy): The organization determines and documents the legal authority that permits the maintenance of personally identifiable information (PII), either generally or in support of a specific program or information system need.
References: NIST: NIST SP 800-53 Revision 4 (v4): AP-1
CCI-003395 (policy): The organization determines and documents the legal authority that permits the sharing of personally identifiable information (PII), either generally or in support of a specific program or information system need.
References: NIST: NIST SP 800-53 Revision 4 (v4): AP-1
CCI-003396 (policy): The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is collected.
References: NIST: NIST SP 800-53 Revision 4 (v4): AP-2
CCI-003397 (policy): The organization appoints a Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO) accountable for developing, implementing, and maintaining an organization-wide governance and privacy program to ensure compliance with all applicable laws and regulations regarding the collection, use, maintenance, sharing, and disposal of personally identifiable information (PII) by programs and information systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 a
CCI-003398 (policy): The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is used.
References: NIST: NIST SP 800-53 Revision 4 (v4): AP-2
CCI-003399 (policy): The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is maintained.
References: NIST: NIST SP 800-53 Revision 4 (v4): AP-2
CCI-003400 (policy): The organization describes, in its privacy notices, the purpose(s) for which personally identifiable information (PII) is shared.
References: NIST: NIST SP 800-53 Revision 4 (v4): AP-2
CCI-003401 (policy): The organization monitors federal privacy laws and policy for changes that affect the privacy program.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 b
CCI-003402 (policy): The organization defines the allocation of budget resources sufficient to implement and operate the organization-wide privacy program.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 c
CCI-003403 (policy): The organization defines the allocation of staffing resources sufficient to implement and operate the organization-wide privacy program.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 c
CCI-003404 (policy): The organization allocates sufficient organization-defined budget resources to implement and operate the organization-wide privacy program.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 c
CCI-003405 (policy): The organization allocates sufficient organization-defined staffing resources to implement and operate the organization-wide privacy program.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 c
CCI-003406 (policy): The organization develops a strategic organizational privacy plan for implementing applicable privacy controls, policies, and procedures.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 d
CCI-003407 (policy): The organization develops operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 e
CCI-003408 (policy): The organization disseminates operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 e
CCI-003409 (policy): The organization implements operational privacy policies which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 e
CCI-003410 (policy): The organization develops operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 e
CCI-003411 (policy): The organization disseminates operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 e
CCI-003412 (policy): The organization implements operational privacy procedures which govern the appropriate privacy and security controls for programs, information systems, or technologies involving personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 e
CCI-003413 (policy): The organization defines the frequency, minimally biennially, on which the privacy plan, policies, and procedures are to be updated.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 f
CCI-003414 (policy): The organization updates the privacy plan per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 f
CCI-003415 (policy): The organization updates the privacy policies per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 f
CCI-003416 (policy): The organization updates the privacy procedures per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-1 f
CCI-003417 (policy): The organization documents a privacy risk management process which assesses the privacy risk to individuals.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a
CCI-003418 (policy): The organization implements a privacy risk management process which assesses the privacy risk to individuals.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a
CCI-003419 (policy): The organization's privacy risk management process assesses the privacy risk to individuals resulting from the collection of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a
CCI-003420 (policy): The organization's privacy risk management process assesses the privacy risk to individuals resulting from the sharing of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a
CCI-003421 (policy): The organization's privacy risk management process assesses the privacy risk to individuals resulting from the storing of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a
CCI-003422 (policy): The organization's privacy risk management process assesses the privacy risk to individuals resulting from the transmitting of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a
CCI-003423 (policy): The organization's privacy risk management process assesses the privacy risk to individuals resulting from the use of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a
CCI-003424 (policy): The organization's privacy risk management process assesses the privacy risk to individuals resulting from the disposal of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-2 a
CCI-003425 (policy): The organization conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-2 b
CCI-003426 (policy): The organization establishes privacy roles for contractors.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-3 a
CCI-003427 (policy): The organization establishes privacy responsibilities for contractors.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-3 a
CCI-003428 (policy): The organization establishes access requirements for contractors.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-3 a
CCI-003429 (policy): The organization establishes privacy roles for service providers.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-3 a
CCI-003430 (policy): The organization establishes privacy responsibilities for service providers.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-3 a
CCI-003431 (policy): The organization establishes access requirements for service providers.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-3 a
CCI-003432 (policy): The organization includes privacy requirements in contracts.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-3 b
CCI-003433 (policy): The organization includes privacy requirements in other acquisition-related documents.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-3 b
CCI-003434 (policy): The organization defines the frequency for monitoring privacy controls and internal privacy policy to ensure effective implementation.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-4
CCI-003435 (policy): The organization defines the frequency for auditing privacy controls and internal privacy policy to ensure effective implementation.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-4
CCI-003436 (policy): The organization monitors privacy controls, per organization-defined frequency, to ensure effective implementation.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-4
CCI-003437 (policy): The organization monitors internal privacy policy to ensure effective implementation.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-4
CCI-003438 (policy): The organization audits privacy controls, per organization-defined frequency, to ensure effective implementation.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-4
CCI-003439 (policy): The organization audits internal privacy policy, per organization-defined frequency, to ensure effective implementation.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-4
CCI-003440 (policy): The organization develops a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-5 a
CCI-003441 (policy): The organization implements a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-5 a
CCI-003442 (policy): The organization updates a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-5 a
CCI-003443 (policy): The organization defines the frequency, minimally annually, for administering its basic privacy training.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-5 b
CCI-003444 (policy): The organization defines the frequency, minimally annually, for administering the targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-5 b
CCI-003445 (policy): The organization administers basic privacy training per the organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-5 b
CCI-003446 (policy): The organization administers, per organization-defined frequency, targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-5 b
CCI-003447 (policy): The organization defines the frequency, minimally annually, on which personnel certify acceptance of responsibilities for privacy requirements.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-5 c
CCI-003448 (policy): The organization ensures personnel certify (manually or electronically) acceptance of responsibilities for privacy requirements per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-5 c
CCI-003449 (policy): The organization develops reports for the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-6
CCI-003450 (policy): The organization disseminates reports to the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-6
CCI-003451 (policy): The organization updates reports for the Office of Management and Budget (OMB), Congress, and other oversight bodies, as appropriate, to demonstrate accountability with specific statutory and regulatory privacy program mandates.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-6
CCI-003452 (policy): The organization develops reports for senior management and other personnel with responsibility for monitoring privacy program progress and compliance.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-6
CCI-003453 (policy): The organization disseminates reports to senior management and other personnel with responsibility for monitoring privacy program progress and compliance.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-6
CCI-003454 (policy): The organization updates reports for senior management and other personnel with responsibility for monitoring privacy program progress and compliance.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-6
CCI-003455 (policy): The organization designs information systems to support privacy by automating privacy controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-7
CCI-003456 (policy): The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the date of each disclosure of a record.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-8 a (1)
CCI-003457 (policy): The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the nature of each disclosure of a record.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-8 a (1)
CCI-003458 (policy): The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the purpose of each disclosure of a record.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-8 a (1)
CCI-003459 (policy): The organization keeps an accurate accounting of disclosures of Privacy Act information held in each system of records under its control.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-8 a (1)
CCI-003460 (policy): The organization, as part of the accurate accounting of disclosures of Privacy Act information held in each system of records under its control, includes the name and address of the person or agency to which the disclosure was made.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-8 a (2)
CCI-003461 (policy): The organization retains the accounting of disclosures for the life of the record or five years after the disclosure is made, whichever is longer.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-8 b
CCI-003462 (policy): The organization makes the accounting of disclosures available to the person named in the record upon request.
References: NIST: NIST SP 800-53 Revision 4 (v4): AR-8 c
CCI-003463 (policy): The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the accuracy of that information.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 a
CCI-003464 (policy): The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the relevancy of that information.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 a
CCI-003465 (policy): The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the timeliness of that information.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 a
CCI-003466 (policy): The organization confirms to the greatest extent practicable upon collection or creation of personally identifiable information (PII), the completeness of that information.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 a
CCI-003467 (policy): The organization collects personally identifiable information (PII) directly from the individual to the greatest extent practicable.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 b
CCI-003468 (policy): The organization defines the frequency on which it will check for, and correct as necessary, inaccurate or outdated personally identifiable information (PII) used by its programs or systems.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 c
CCI-003469 (policy): The organization checks for, and corrects as necessary, any inaccurate or outdated personally identifiable information (PII) used by its programs or systems on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 c
CCI-003470 (policy): The organization issues guidelines ensuring the quality of disseminated Privacy Act information.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d
CCI-003471 (policy): The organization issues guidelines ensuring the utility of disseminated Privacy Act information.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d
CCI-003472 (policy): The organization issues guidelines ensuring the objectivity of disseminated Privacy Act information.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d
CCI-003473 (policy): The organization issues guidelines ensuring the integrity of disseminated Privacy Act information.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d
CCI-003474 (policy): The organization issues guidelines maximizing the quality of disseminated Privacy Act information.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d
CCI-003475 (policy): The organization issues guidelines maximizing the utility of disseminated Privacy Act information.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d
CCI-003476 (policy): The organization issues guidelines maximizing the objectivity of disseminated Privacy Act information.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d
CCI-003477 (policy): The organization issues guidelines maximizing the integrity of disseminated Privacy Act information.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 d
CCI-003478 (policy): The organization requests the individual or individual's authorized representative validate personally identifiable information (PII) during the collection process.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 (1)
CCI-003479 (policy): The organization defines the frequency on which it will request the individual, or individual's authorized representative, revalidate that personally identifiable information (PII) collected is still accurate.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 (2)
CCI-003480 (policy): On an organization-defined frequency, the organization requests the individual, or individual's authorized representative, revalidate that personally identifiable information (PII) collected is still accurate.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-1 (2)
CCI-003481 (policy): The organization documents processes to ensure the integrity of personally identifiable information (PII) through existing security controls.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-2 a
CCI-003482 (policy): The organization, when appropriate, establishes a Data Integrity Board.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-2 b
CCI-003483 (policy): The organization's Data Integrity Board oversees the organizational Computer Matching Agreements.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-2 b
CCI-003484 (policy): The organization's Data Integrity Board ensures the Computer Matching Agreements comply with the computer matching provisions of the Privacy Act.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-2 b
CCI-003485 (policy): The organization publishes Computer Matching Agreements on its public website.
References: NIST: NIST SP 800-53 Revision 4 (v4): DI-2 (1)
CCI-003486 (policy): The organization identifies the minimum personally identifiable information (PII) elements that are relevant and necessary to accomplish the legally authorized purpose of collection.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-1 a
CCI-003487 (policy): The organization limits the collection and retention of personally identifiable information (PII) to the minimum elements identified for the purposes described in the published privacy notice.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-1 b
CCI-003488 (policy): The organization limits the collection and retention of personally identifiable information (PII) to the minimum elements identified for the purposes which the individual has provided consent.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-1 b
CCI-003489 (policy): The organization defines the frequency, minimally annually, for conducting reviews of its personally identifiable information (PII) holdings.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-1 c
CCI-003490 (policy): The organization conducts an initial evaluation of personally identifiable information (PII) holdings.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-1 c
CCI-003491 (policy): The organization establishes a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure that only PII identified in the notice is collected and retained.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-1 c
CCI-003492 (policy): The organization follows a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure that only PII identified in the notice is collected and retained.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-1 c
CCI-003493 (policy): The organization establishes a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure the PII continues to be necessary to accomplish the legally authorized purpose.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-1 c
CCI-003494 (policy): The organization follows a schedule for regularly reviewing the personally identifiable information (PII) holdings on an organization-defined frequency to ensure the PII continues to be necessary to accomplish the legally authorized purpose.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-1 c
CCI-003495 (policy): The organization, where feasible and within the limits of technology, locates and removes/redacts specified personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-1 (1)
CCI-003496 (policy): The organization, where feasible and within the limits of technology, uses anonymization and de-identification techniques to permit use of the retained Privacy Act information while reducing its sensitivity and reducing the risk resulting from disclosure.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-1 (1)
CCI-003497 (policy): The organization defines the time period for retaining each collection of personally identifiable information (PII) that is required to fulfill the purpose(s) identified in the published privacy notice or required by law.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-2 a
CCI-003498 (policy): The organization retains each collection of personally identifiable information (PII) for the organization-defined time period to fulfill the purpose(s) identified in the published privacy notice or as required by law.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-2 a
CCI-003499 (policy): The organization disposes of, destroys, erases, and/or anonymizes the personally identifiable information (PII), regardless of the method of storage, in accordance with a NARA-approved record retention schedule.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-2 b
CCI-003500 (policy): The organization disposes of, destroys, erases, and/or anonymizes the personally identifiable information (PII), regardless of the method of storage, in a manner that prevents loss, theft, misuse, or unauthorized access.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-2 b
CCI-003501 (policy): The organization defines the techniques or methods to be employed to ensure the secure deletion or destruction of personally identifiable information (PII) (including originals, copies, and archived records).
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-2 c
CCI-003502 (policy): The organization uses organization-defined techniques or methods to ensure secure deletion or destruction of personally identifiable information (PII) (including originals, copies, and archived records).
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-2 c
CCI-003503 (policy): The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is collected, created, or updated.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-2 (1)
CCI-003504 (policy): The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is created.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-2 (1)
CCI-003505 (policy): The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is updated.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-2 (1)
CCI-003506 (policy): The organization, where feasible, configures its information systems to record when personally identifiable information (PII) is to be deleted or archived under an approved record retention schedule.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-2 (1)
CCI-003507 (policy): The organization develops policies that minimize the use of personally identifiable information (PII) for testing.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-3 a
CCI-003508 (policy): The organization develops policies that minimize the use of personally identifiable information (PII) for training.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-3 a
CCI-003509 (policy): The organization develops policies that minimize the use of personally identifiable information (PII) for research.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-3 a
CCI-003510 (policy): The organization develops procedures that minimize the use of personally identifiable information (PII) for testing.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-3 a
CCI-003511 (policy): The organization develops procedures that minimize the use of personally identifiable information (PII) for training.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-3 a
CCI-003512 (policy): The organization develops procedures that minimize the use of personally identifiable information (PII) for research.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-3 a
CCI-003513 (policy): The organization implements controls to protect personally identifiable information (PII) used for testing.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-3 b
CCI-003514 (policy): The organization implements controls to protect personally identifiable information (PII) used for training.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-3 b
CCI-003515 (policy): The organization implements controls to protect personally identifiable information (PII) used for research.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-3 b
CCI-003516 (policy): The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for research.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-3 (1)
CCI-003517 (policy): The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for testing.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-3 (1)
CCI-003518 (policy): The organization, where feasible, uses techniques to minimize the risk to privacy of using personally identifiable information (PII) for training.
References: NIST: NIST SP 800-53 Revision 4 (v4): DM-3 (1)
CCI-003519 (policy): The organization provides means, where feasible and appropriate, for individuals to authorize the collection of personally identifiable information (PII) prior to its collection.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-1 a
CCI-003520 (policy): The organization provides means, where feasible and appropriate, for individuals to authorize the use of personally identifiable information (PII) prior to its collection.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-1 a
CCI-003521 (policy): The organization provides means, where feasible and appropriate, for individuals to authorize the maintaining of personally identifiable information (PII) prior to its collection.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-1 a
CCI-003522 (policy): The organization provides means, where feasible and appropriate, for individuals to authorize sharing of personally identifiable information (PII) prior to its collection.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-1 a
CCI-003523 (policy): The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the collection of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-1 b
CCI-003524 (policy): The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the use of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-1 b
CCI-003525 (policy): The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the dissemination of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-1 b
CCI-003526 (policy): The organization provides appropriate means for individuals to understand the consequences of decisions to approve or decline the authorization of the retention of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-1 b
CCI-003527 (policy): The organization obtains consent, where feasible and appropriate, from individuals prior to any new uses or disclosure of previously collected personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-1 c
CCI-003528 (policy): The organization ensures that individuals are aware of all uses of personally identifiable information (PII) not initially described in the public notice that was in effect at the time the organization collected the PII.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-1 d
CCI-003529 (policy): The organization ensures that individuals, where feasible, consent to all uses of personally identifiable information (PII) not initially described in the public notice that was in effect at the time the organization collected the PII.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-1 d
CCI-003530 (policy): The organization implements mechanisms to support itemized or tiered consent for specific uses of personally identifiable information (PII) data.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-1 (1)
CCI-003531 (policy): The organization provides individuals the ability to have access to their personally identifiable information (PII) maintained in its system(s) of records.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-2 a
CCI-003532 (policy): The organization publishes rules and regulations governing how individuals may request access to records maintained in a Privacy Act system of records.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-2 b
CCI-003533 (policy): The organization publishes regulations governing how individuals may request access to records maintained in a Privacy Act system of records.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-2 b
CCI-003534 (policy): The organization publishes access procedures for Privacy Act systems of records in System of Records Notices (SORNs).
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-2 c
CCI-003535 (policy): The organization adheres to Privacy Act requirements for the proper processing of Privacy Act requests.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-2 d
CCI-003536 (policy): The organization adheres to OMB policies and guidance for the proper processing of Privacy Act requests.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-2 d
CCI-003537 (policy): The organization provides a process for individuals to have inaccurate personally identifiable information (PII) maintained by the organization corrected or amended, as appropriate.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-3 a
CCI-003538 (policy): The organization establishes a process for disseminating corrections or amendments of the personally identifiable information (PII) to other authorized users of the PII, such as external information-sharing partners.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-3 b
CCI-003539 (policy): The organization establishes a process, where feasible and appropriate, to notify affected individuals that their personally identifiable information (PII) information has been corrected or amended.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-3 b
CCI-003540 (policy): The organization implements a process for receiving complaints, concerns, or questions from individuals about the organizational privacy practices.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-4
CCI-003541 (policy): The organization implements a process for responding to complaints, concerns, or questions from individuals about the organizational privacy practices.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-4
CCI-003542 (policy): The organization defines the time period within which it must respond to complaints, concerns, or questions from individuals about the organizational privacy practices.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-4 (1)
CCI-003543 (policy): The organization responds to complaints, concerns, or questions from individuals about the organizational privacy practices within the organization-defined time period.
References: NIST: NIST SP 800-53 Revision 4 (v4): IP-4 (1)
CCI-003544 (policy): The organization defines the frequency on which it will update the inventory that contains a listing of all programs and information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a
CCI-003545 (policy): The organization establishes an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a
CCI-003546 (policy): The organization establishes an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a
CCI-003547 (policy): The organization maintains an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a
CCI-003548 (policy): The organization maintains an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a
CCI-003549 (policy): The organization updates, per organization-defined frequency, an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a
CCI-003550 (policy): The organization updates, per organization-defined frequency, an inventory that contains a listing of all information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): SE-1 a
CCI-003551 (policy): The organization defines the frequency for providing each update of the personally identifiable information (PII) inventory to the CIO or information security official.
References: NIST: NIST SP 800-53 Revision 4 (v4): SE-1 b
CCI-003552 (policy): The organization provides each update of the personally identifiable information (PII) inventory to the CIO or information security official, per organization-defined frequency, to support the establishment of information security requirements for all new or modified information systems containing PII.
References: NIST: NIST SP 800-53 Revision 4 (v4): SE-1 b
CCI-003553 (policy): The organization develops a Privacy Incident Response Plan.
References: NIST: NIST SP 800-53 Revision 4 (v4): SE-2 a
CCI-003554 (policy): The organization implements a Privacy Incident Response Plan.
References: NIST: NIST SP 800-53 Revision 4 (v4): SE-2 a
CCI-003555 (policy): The organization provides an organized and effective response to privacy incidents in accordance with the organizational Privacy Incident Response Plan.
References: NIST: NIST SP 800-53 Revision 4 (v4): SE-2 b
CCI-003556 (policy): The organization provides effective notice to the public regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a
CCI-003557 (policy): The organization provides effective notice to individuals regarding its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a
CCI-003558 (policy): The organization provides effective notice to the public regarding its authority for collecting personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a
CCI-003559 (policy): The organization provides effective notice to individuals regarding its authority for collecting personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a
CCI-003560 (policy): The organization provides effective notice to the public regarding the choices, if any, individuals may have regarding how the organization uses personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a
CCI-003561 (policy): The organization provides effective notice to individuals regarding the choices, if any, individuals may have regarding how the organization uses personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a
CCI-003562 (policy): The organization provides effective notice to the public regarding the consequences of exercising or not exercising the choices regarding how the organization uses personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a
CCI-003563 (policy): The organization provides effective notice to individuals regarding the consequences of exercising or not exercising the choices regarding how the organization uses personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a
CCI-003564 (policy): The organization provides effective notice to the public regarding the ability of individuals to access personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a
CCI-003565 (policy): The organization provides effective notice to individuals regarding the ability to access personally identifiable information (PII).
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a
CCI-003566 (policy): The organization provides effective notice to the public regarding the ability to have personally identifiable information (PII) amended or corrected if necessary.
References: NIST: NIST SP 800-53 Revision 4 (v4): TR-1 a