CCI-004553

Defines the processing of personally identifiable information to only that which is compatible with the identified purpose(s).

Implementation Guidance

Determine if the [PT-03_ODP[02]; the processing of personally identifiable information to be restricted is defined] of personally identifiable information are restricted to only that which is compatible with the identified purpose(s).

Validation Procedures

Examine: [SELECT FROM: Personally identifiable information processing and transparency policy and procedures; configuration management plan; organizational privacy notices; organizational policies; Privacy Act statements; computer matching notices; applicable Federal Register notices; documented requirements for enforcing and monitoring the processing of personally identifiable information; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for authorizing the processing of personally identifiable information; mechanisms supporting and/or implementing the management of authorized personally identifiable information processing; organizational processes for monitoring changes in processing personally identifiable information].

The controls below (if any) were marked by NIST as being related to CCI-004553.