CCI-004541

Implementation Guidance

Determine if the [PT-02_ODP[01]; the authority to permit the processing (defined in PT-02_ODP[02]) of personally identifiable information is defined] that permits the [PT-02_ODP[02]; the type of processing of personally identifiable information is defined] of personally identifiable information is determined and documented.

Validation Procedures

Examine: [SELECT FROM: Personally identifiable information processing and transparency policy and procedures; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for authorizing the processing of personally identifiable information; mechanisms supporting and/or implementing the restriction of personally identifiable information processing].