CCI-003417

CCI-003417 Definition

The organization documents a privacy risk management process which assesses the privacy risk to individuals.

Status
Type	CheckType.policy

The controls below (if any) were marked by NIST as being related to CCI-003417.

Control	Description
AR-2	The organization: a. Documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII); and b. Conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.

Control

Description