CCI-003503

The organization, where feasible, configures its information systems to record the date personally identifiable information (PII) is collected, created, or updated.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to configure, where feasible, its information systems to record the date PII is collected, created, or updated.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed configures, where feasible, its information systems to record the date PII is collected, created, or updated.

Compelling Evidence

1.) Site must produce a signed document which describes how the site configures its information systems to record the date PII is collected, created, or updated. 2.) Reviewer will verify that the documentation exists. 3.) Reviewer will verify that the documentation describes how the site configures its information systems to record the date PII is collected, created, or updated.

The controls below (if any) were marked by NIST as being related to CCI-003503.