CCI-004543

Defines the processing of the personally identifiable information to only that which is authorized.

Implementation Guidance

Determine if the [PT-02_ODP[03]; the type of processing of personally identifiable information to be restricted is defined] of personally identifiable information is restricted to only that which is authorized.

Validation Procedures

Examine: [SELECT FROM: Personally identifiable information processing and transparency policy and procedures; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for authorizing the processing of personally identifiable information; mechanisms supporting and/or implementing the restriction of personally identifiable information processing].

The controls below (if any) were marked by NIST as being related to CCI-004543.