Navigate

CCI-003545

CCI-003545 Definition

The organization establishes an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing personally identifiable information (PII).

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed establishes and documents an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing PII.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented inventory to ensure the organization being inspected/assessed establishes an inventory that contains a listing of all programs identified as collecting, using, maintaining, or sharing PII.

Compelling Evidence

dated inventory list of programs containing PII. Verify date is within organization defined interval

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003545.

Control	Description
SE-1	The organization: SE-1a.: Establishes, maintains, and updates [Assignment: organization-defined frequency] an inventory that contains a listing of all programs and information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII); and SE-1b.: Provides each update of the PII inventory to the CIO or information security official [Assignment: organization-defined frequency] to support the establishment of information security requirements for all new or modified information systems containing PII.

Control

Description

SE-1

The organization:

SE-1a.: Establishes, maintains, and updates [Assignment: organization-defined frequency] an inventory that contains a listing of all programs and information systems identified as collecting, using, maintaining, or sharing personally identifiable information (PII); and

SE-1b.: Provides each update of the PII inventory to the CIO or information security official [Assignment: organization-defined frequency] to support the establishment of information security requirements for all new or modified information systems containing PII.