CCI-003440

The organization develops a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.

Implementation Guidance

The organization being inspected/assessed documents whether the IASE PII Training provides personnel with the information necessary to understand their roles and responsibilities, or if additional organization-specific training is required. If organization-specific training is required, the organization being inspected/assessed defines and documents the unique privacy needs which must be addressed by training.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented evidence of a review as to whether the IASE provided PII training provides personnel with the information necessary to understand their roles and responsibilities. If the documented review indicates that organization-specific training is necessary, then the organization conducting the inspection/assessment obtains and examines documentation identifying the unique privacy needs which must be addressed by training to ensure they are identified.

Compelling Evidence

Reference section of documentation that pertains to IASE PII training. Observe that If extra training is required the organization needs to define and document the unique privacy needs which must be addressed by training.

The controls below (if any) were marked by NIST as being related to CCI-003440.