CCI-003506

The organization, where feasible, configures its information systems to record when personally identifiable information (PII) is to be deleted or archived under an approved record retention schedule.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to configure, where feasible, its information systems to record when PII is to be deleted or archived under a NARA-approved record retention schedule.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed, where feasible, configures its information systems to record when PII is to be deleted or archived under a NARA-approved record retention schedule.

Compelling Evidence

1.) Site must produce a signed document which describes how the site configures its information systems to record when PII is to be deleted or archived. 2.) Reviewer will verify that the documentation exists. 3.) Reviewer will verify that the documentation describes the process that the site follows to configures its information systems to record when PII is to be deleted or archived. 4.) Reviewer must valid that the site implements and follows NARA-approved record retention schedule.

The controls below (if any) were marked by NIST as being related to CCI-003506.