CCI-003497

The organization defines the time period for retaining each collection of personally identifiable information (PII) that is required to fulfill the purpose(s) identified in the published privacy notice or required by law.

Implementation Guidance

The organization being inspected/assessed must define and document the time period IAW the NARA-approved Records Schedule and the Privacy Act System of Records Notice. DoD has determined the time period is not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented time period to ensure the organization being inspected/assessed define and document the time period IAW the NARA-approved Records Schedule and the Privacy Act System of Records Notice. DoD has determined the time period is not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Site must produce a signed document which defines the time period for retaining each collection of PII. 2.) Reviewer will validate that the documentation exists and that it defines and documents the time period IAW the NARA-approved Records Schedule and the Privacy Act System of Records Notice.

The controls below (if any) were marked by NIST as being related to CCI-003497.