CCI-004545

Defines the authorized processing which will attach data tags to organization-defined elements of personally identifiable information.

Implementation Guidance

Determine if data tags containing [PT-02(01)_ODP[01]; the authorized processing of personally identifiable information is defined] are attached to [PT-02(01)_ODP[02]; elements of personally identifiable information to be tagged are defined].

Validation Procedures

Examine: [SELECT FROM: Personally identifiable information processing and transparency policy and procedures including procedures addressing data tagging; data tag definitions; documented requirements for use and monitoring of data tagging; data extracts with corresponding data tags; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for authorizing the processing of personally identifiable information; organizational processes for data tagging; mechanisms for applying and monitoring data tagging; mechanisms supporting and/or implementing the restriction of personally identifiable information processing].

The controls below (if any) were marked by NIST as being related to CCI-004545.