Navigate

CCI-003544

CCI-003544 Definition

The organization defines the frequency on which it will update the inventory that contains a listing of all programs and information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII).

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

DoD has defined the frequency as within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs.

Validation Procedures

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as within three years of PIA approval and when a significant system change or a change in privacy or security posture occurs.

Compelling Evidence

SSP detailing how often the inventory is to be accomplished

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003544.

Control	Description
SE-1	The organization: SE-1a.: Establishes, maintains, and updates [Assignment: organization-defined frequency] an inventory that contains a listing of all programs and information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII); and SE-1b.: Provides each update of the PII inventory to the CIO or information security official [Assignment: organization-defined frequency] to support the establishment of information security requirements for all new or modified information systems containing PII.

Control

Description

SE-1

The organization:

SE-1a.: Establishes, maintains, and updates [Assignment: organization-defined frequency] an inventory that contains a listing of all programs and information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII); and

SE-1b.: Provides each update of the PII inventory to the CIO or information security official [Assignment: organization-defined frequency] to support the establishment of information security requirements for all new or modified information systems containing PII.