CCI-003444

The organization defines the frequency, minimally annually, for administering the targeted, role-based privacy training for personnel having responsibility for personally identifiable information (PII) or for activities that involve PII.

Implementation Guidance

If the organization being inspected/assessed identifies IAW AR-5, CCI 3440 that IASE provided PII training meets the needs of the organization then the organization is automatically compliant. Otherwise, the organization being inspected/assessed documents and implements a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented results of the review conducted IAW AR-5, CCI 3440. If the review indicates that IASE provided PII training meets the needs of the organization then the organization is automatically compliant. Otherwise, the organization conducting the inspection/assessment obtains and examines the documented training and awareness strategy to ensure that it implements training aimed at ensuring that personnel understand privacy responsibilities and procedures.

Compelling Evidence

Reference section of documentation that pertains to IASE PII training. Observe that If extra training is required the organization needs to define and document the unique privacy needs which must be addressed by training.

The controls below (if any) were marked by NIST as being related to CCI-003444.