ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
PS > PS-8 > Discussion

PS-8 Personnel Sanctions - Discussion
Family: Personnel Security (PS)

Organizational sanctions reflect applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Sanctions processes are described in access agreements and can be included as part of general personnel policies for organizations and/or specified in security and privacy policies. Organizations consult with the Office of the General Counsel regarding matters of employee sanctions.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-9

PS-9 Position Descriptions
Family: Personnel Security (PS)

Incorporate security and privacy roles and responsibilities into organizational position descriptions.
Security and Privacy Controls for Information Systems and Organizations
PS > PS-9 > Discussion

PS-9 Position Descriptions - Discussion
Family: Personnel Security (PS)

Specification of security and privacy roles in individual organizational position descriptions facilitates clarity in understanding the security or privacy responsibilities associated with the roles and the role-based security and privacy training requirements for the roles.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-1

PT-1 Policy and Procedures
Family: Personally Identifiable Information Processing and Transparency (PT)

a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:
1. [Selection; one or more: organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls;
b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures; and
c. Review and update the current personally identifiable information processing and transparency:
1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and
2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
Security and Privacy Controls for Information Systems and Organizations
PT > PT-1 > Discussion

PT-1 Policy and Procedures - Discussion
Family: Personally Identifiable Information Processing and Transparency (PT)

Personally identifiable information processing and transparency policy and procedures address the controls in the PT family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of personally identifiable information processing and transparency policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to personally identifiable information processing and transparency policy and procedures include assessment or audit findings, breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-2

PT-2 Authority to Process Personally Identifiable Information
Family: Personally Identifiable Information Processing and Transparency (PT)

a. Determine and document the [Assignment: organization-defined authority] that permits the [Assignment: organization-defined processing] of personally identifiable information; and
b. Restrict the [Assignment: organization-defined processing] of personally identifiable information to only that which is authorized.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-2 > Discussion

PT-2 Authority to Process Personally Identifiable Information - Discussion
Family: Personally Identifiable Information Processing and Transparency (PT)

The processing of personally identifiable information is an operation or set of operations that the information system or organization performs with respect to personally identifiable information across the information life cycle. Processing includes but is not limited to creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal. Processing operations also include logging, generation, and transformation, as well as analysis techniques, such as data mining.

Organizations may be subject to laws, executive orders, directives, regulations, or policies that establish the organization's authority and thereby limit certain types of processing of personally identifiable information or establish other requirements related to the processing. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such authority, particularly if the organization is subject to multiple jurisdictions or sources of authority. For organizations whose processing is not determined according to legal authorities, the organization's policies and determinations govern how they process personally identifiable information. While processing of personally identifiable information may be legally permissible, privacy risks may still arise. Privacy risk assessments can identify the privacy risks associated with the authorized processing of personally identifiable information and support solutions to manage such risks.

Organizations consider applicable requirements and organizational policies to determine how to document this authority. For federal agencies, the authority to process personally identifiable information is documented in privacy policies and notices, system of records notices, privacy impact assessments, [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statements, computer matching agreements and notices, contracts, information sharing agreements, memoranda of understanding, and other documentation.

Organizations take steps to ensure that personally identifiable information is only processed for authorized purposes, including training organizational personnel on the authorized processing of personally identifiable information and monitoring and auditing organizational use of personally identifiable information.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-2 > PT-2(1) > Discussion

PT-2(1) Data Tagging - Discussion
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-2 Authority to Process Personally Identifiable Information

Data tags support the tracking and enforcement of authorized processing by conveying the types of processing that are authorized along with the relevant elements of personally identifiable information throughout the system. Data tags may also support the use of automated tools.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-2 > PT-2(1)

PT-2(1) Authority to Process Personally Identifiable Information | Data Tagging
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-2 Authority to Process Personally Identifiable Information

Attach data tags containing [Assignment: organization-defined authorized processing] to [Assignment: organization-defined elements of personally identifiable information].
Security and Privacy Controls for Information Systems and Organizations
PT > PT-2 > PT-2(2) > Discussion

PT-2(2) Automation - Discussion
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-2 Authority to Process Personally Identifiable Information

Automated mechanisms augment verification that only authorized processing is occurring.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-2 > PT-2(2)

PT-2(2) Authority to Process Personally Identifiable Information | Automation
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-2 Authority to Process Personally Identifiable Information

Manage enforcement of the authorized processing of personally identifiable information using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
PT > PT-3

PT-3 Personally Identifiable Information Processing Purposes
Family: Personally Identifiable Information Processing and Transparency (PT)

a. Identify and document the [Assignment: organization-defined purpose(s)] for processing personally identifiable information;
b. Describe the purpose(s) in the public privacy notices and policies of the organization;
c. Restrict the [Assignment: organization-defined processing] of personally identifiable information to only that which is compatible with the identified purpose(s); and
d. Monitor changes in processing personally identifiable information and implement [Assignment: organization-defined mechanisms] to ensure that any changes are made in accordance with [Assignment: organization-defined requirements].
Security and Privacy Controls for Information Systems and Organizations
PT > PT-3 > Discussion

PT-3 Personally Identifiable Information Processing Purposes - Discussion
Family: Personally Identifiable Information Processing and Transparency (PT)

Identifying and documenting the purpose for processing provides organizations with a basis for understanding why personally identifiable information may be processed. The term "process" includes every step of the information life cycle, including creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal. Identifying and documenting the purpose of processing is a prerequisite to enabling owners and operators of the system and individuals whose information is processed by the system to understand how the information will be processed. This enables individuals to make informed decisions about their engagement with information systems and organizations and to manage their privacy interests. Once the specific processing purpose has been identified, the purpose is described in the organization's privacy notices, policies, and any related privacy compliance documentation, including privacy impact assessments, system of records notices, [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statements, computer matching notices, and other applicable Federal Register notices.

Organizations take steps to help ensure that personally identifiable information is processed only for identified purposes, including training organizational personnel and monitoring and auditing organizational processing of personally identifiable information.

Organizations monitor for changes in personally identifiable information processing. Organizational personnel consult with the senior agency official for privacy and legal counsel to ensure that any new purposes that arise from changes in processing are compatible with the purpose for which the information was collected, or if the new purpose is not compatible, implement mechanisms in accordance with defined requirements to allow for the new processing, if appropriate. Mechanisms may include obtaining consent from individuals, revising privacy policies, or other measures to manage privacy risks that arise from changes in personally identifiable information processing purposes.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-3 > PT-3(1) > Discussion

PT-3(1) Data Tagging - Discussion
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-3 Personally Identifiable Information Processing Purposes

Data tags support the tracking of processing purposes by conveying the purposes along with the relevant elements of personally identifiable information throughout the system. By conveying the processing purposes in a data tag along with the personally identifiable information as the information transits a system, a system owner or operator can identify whether a change in processing would be compatible with the identified and documented purposes. Data tags may also support the use of automated tools.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-3 > PT-3(1)

PT-3(1) Personally Identifiable Information Processing Purposes | Data Tagging
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-3 Personally Identifiable Information Processing Purposes

Attach data tags containing the following purposes to [Assignment: organization-defined elements of personally identifiable information]: [Assignment: organization-defined processing purposes].
Security and Privacy Controls for Information Systems and Organizations
PT > PT-3 > PT-3(2) > Discussion

PT-3(2) Automation - Discussion
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-3 Personally Identifiable Information Processing Purposes

Automated mechanisms augment tracking of the processing purposes.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-3 > PT-3(2)

PT-3(2) Personally Identifiable Information Processing Purposes | Automation
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-3 Personally Identifiable Information Processing Purposes

Track processing purposes of personally identifiable information using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
PT > PT-4

PT-4 Consent
Family: Personally Identifiable Information Processing and Transparency (PT)

Implement [Assignment: organization-defined tools or mechanisms] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-4 > Discussion

PT-4 Consent - Discussion
Family: Personally Identifiable Information Processing and Transparency (PT)

Consent allows individuals to participate in making decisions about the processing of their information and transfers some of the risk that arises from the processing of personally identifiable information from the organization to an individual. Consent may be required by applicable laws, executive orders, directives, regulations, policies, standards, or guidelines. Otherwise, when selecting consent as a control, organizations consider whether individuals can be reasonably expected to understand and accept the privacy risks that arise from their authorization. Organizations consider whether other controls may more effectively mitigate privacy risk either alone or in conjunction with consent. Organizations also consider any demographic or contextual factors that may influence the understanding or behavior of individuals with respect to the processing carried out by the system or organization. When soliciting consent from individuals, organizations consider the appropriate mechanism for obtaining consent, including the type of consent (e.g., opt-in, opt-out), how to properly authenticate and identity proof individuals and how to obtain consent through electronic means. In addition, organizations consider providing a mechanism for individuals to revoke consent once it has been provided, as appropriate. Finally, organizations consider usability factors to help individuals understand the risks being accepted when providing consent, including the use of plain language and avoiding technical jargon.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-4 > PT-4(1) > Discussion

PT-4(1) Tailored Consent - Discussion
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-4 Consent

While some processing may be necessary for the basic functionality of the product or service, other processing may not. In these circumstances, organizations allow individuals to select how specific personally identifiable information elements may be processed. More tailored consent may help reduce privacy risk, increase individual satisfaction, and avoid adverse behaviors, such as abandonment of the product or service.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-4 > PT-4(1)

PT-4(1) Consent | Tailored Consent
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-4 Consent

Provide [Assignment: organization-defined mechanisms] to allow individuals to tailor processing permissions to selected elements of personally identifiable information.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-4 > PT-4(2) > Discussion

PT-4(2) Just-in-time Consent - Discussion
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-4 Consent

Just-in-time consent enables individuals to participate in how their personally identifiable information is being processed at the time or in conjunction with specific types of data processing when such participation may be most useful to the individual. Individual assumptions about how personally identifiable information is being processed might not be accurate or reliable if time has passed since the individual last gave consent or the type of processing creates significant privacy risk. Organizations use discretion to determine when to use just-in-time consent and may use supporting information on demographics, focus groups, or surveys to learn more about individuals' privacy interests and concerns.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-4 > PT-4(2)

PT-4(2) Consent | Just-in-time Consent
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-4 Consent

Present [Assignment: organization-defined consent mechanisms] to individuals at [Assignment: organization-defined frequency] and in conjunction with [Assignment: organization-defined personally identifiable information processing].
Security and Privacy Controls for Information Systems and Organizations
PT > PT-4 > PT-4(3) > Discussion

PT-4(3) Revocation - Discussion
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-4 Consent

Revocation of consent enables individuals to exercise control over their initial consent decision when circumstances change. Organizations consider usability factors in enabling easy-to-use revocation capabilities.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-4 > PT-4(3)

PT-4(3) Consent | Revocation
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-4 Consent

Implement [Assignment: organization-defined tools or mechanisms] for individuals to revoke consent to the processing of their personally identifiable information.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-5

PT-5 Privacy Notice
Family: Personally Identifiable Information Processing and Transparency (PT)

Provide notice to individuals about the processing of personally identifiable information that:
a. Is available to individuals upon first interacting with an organization, and subsequently at [Assignment: organization-defined frequency];
b. Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language;
c. Identifies the authority that authorizes the processing of personally identifiable information;
d. Identifies the purposes for which personally identifiable information is to be processed; and
e. Includes [Assignment: organization-defined information].
Security and Privacy Controls for Information Systems and Organizations
PT > PT-5 > Discussion

PT-5 Privacy Notice - Discussion
Family: Personally Identifiable Information Processing and Transparency (PT)

Privacy notices help inform individuals about how their personally identifiable information is being processed by the system or organization. Organizations use privacy notices to inform individuals about how, under what authority, and for what purpose their personally identifiable information is processed, as well as other information such as choices individuals might have with respect to that processing and other parties with whom information is shared. Laws, executive orders, directives, regulations, or policies may require that privacy notices include specific elements or be provided in specific formats. Federal agency personnel consult with the senior agency official for privacy and legal counsel regarding when and where to provide privacy notices, as well as elements to include in privacy notices and required formats. In circumstances where laws or government-wide policies do not require privacy notices, organizational policies and determinations may require privacy notices and may serve as a source of the elements to include in privacy notices.

Privacy risk assessments identify the privacy risks associated with the processing of personally identifiable information and may help organizations determine appropriate elements to include in a privacy notice to manage such risks. To help individuals understand how their information is being processed, organizations write materials in plain language and avoid technical jargon.
Security and Privacy Controls for Information Systems and Organizations
PT > PT-5 > PT-5(1) > Discussion

PT-5(1) Just-in-time Notice - Discussion
Family: Personally Identifiable Information Processing and Transparency (PT) > PT-5 Privacy Notice

Just-in-time notices inform individuals of how organizations process their personally identifiable information at a time when such notices may be most useful to the individuals. Individual assumptions about how personally identifiable information will be processed might not be accurate or reliable if time has passed since the organization last presented notice or the circumstances under which the individual was last provided notice have changed. A just-in-time notice can explain data actions that organizations have identified as potentially giving rise to greater privacy risk for individuals. Organizations can use a just-in-time notice to update or remind individuals about specific data actions as they occur or highlight specific changes that occurred since last presenting notice. A just-in-time notice can be used in conjunction with just-in-time consent to explain what will occur if consent is declined. Organizations use discretion to determine when to use a just-in-time notice and may use supporting information on user demographics, focus groups, or surveys to learn about users' privacy interests and concerns.