Navigate

CCI-003419

CCI-003419 Definition

The organization's privacy risk management process assesses the privacy risk to individuals resulting from the collection of personally identifiable information (PII).

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed documents a privacy risk management process which assesses the privacy risk to individuals resulting from the collection of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented privacy risk management process which assesses the privacy risk to individuals resulting from the collection of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)

Compelling Evidence

Supply documentation that refers to privacy risk management process which assesses the privacy risk to individuals resulting from the collection of PII. (http://iatraining.disa.mil/eta/piiv2/launchPage.htm)

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003419.

Control	Description
AR-2	The organization: a. Documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII); and b. Conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.

Control

Description

AR-2

The organization: a. Documents and implements a privacy risk management process that assesses privacy risk to individuals resulting from the collection, sharing, storing, transmitting, use, and disposal of personally identifiable information (PII); and b. Conducts Privacy Impact Assessments (PIAs) for information systems, programs, or other activities that pose a privacy risk in accordance with applicable law, OMB policy, or any existing organizational policies and procedures.