CCI-003495

The organization, where feasible and within the limits of technology, locates and removes/redacts specified personally identifiable information (PII).

Implementation Guidance

The organization being inspected/assessed documents and implements a process to locate and remove/redact specified PII, where feasible and within the limits of technology.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed where feasible and within the limits of technology, locates and removes/redacts specified PII.

Compelling Evidence

1.) Site must produce a signed documented process of how to locate and remove/redact specified PII, where feasible and within the limits of technology. 2.) Reviewer will validate the existence of documentation. 3.) Reviewer will validate that the documentation describes a process to locate and remove/redact specified PII, within the limits of technology that the site uses. 4.) Reviewer will validate that the site implements and follows a process to locate and remove/redact specified PII.

The controls below (if any) were marked by NIST as being related to CCI-003495.