Navigate

CCI-004410

CCI-004410 Definition

Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if the accounting of disclosures is retained for the length of time that the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer.

Validation Procedures

Examine: [SELECT FROM: Privacy program plan; disclosure policies and procedures; records of disclosures; audit logs; Privacy Act policies and procedures; system of records notice; Privacy Act exemption rules.]. Interview: [SELECT FROM: Organizational personnel with privacy program responsibilities; organizational personnel with privacy responsibilities.]. Test: [SELECT FROM: Organizational processes for disclosures; mechanisms supporting the accounting of disclosures, including commercial services that provide notifications and alerts.].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004410.

Control	Description
PM-21	a: Develop and maintain an accurate accounting of disclosures of personally identifiable information, including: 1: Date, nature, and purpose of each disclosure; and 2: Name and address, or other contact information of the individual or organization to which the disclosure was made; b: Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer; and c: Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.

Control

Description

PM-21

a: Develop and maintain an accurate accounting of disclosures of personally identifiable information, including:
- 1: Date, nature, and purpose of each disclosure; and
- 2: Name and address, or other contact information of the individual or organization to which the disclosure was made;

b: Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer; and

c: Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.