Navigate

CCI-003418

CCI-003418 Definition

The organization implements a privacy risk management process which assesses the privacy risk to individuals.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed implements a privacy risk management process which assesses the privacy risk to individuals.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documents which implement a privacy risk management process which assesses the privacy risk to individuals.

Compelling Evidence

Supply documentation of privacy risk management process which assesses the privacy risk to individuals.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003418.

Control	Description
AR-2	The organization: a. Documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII); and b. Conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.

Control

Description

AR-2

The organization: a. Documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII); and b. Conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.