CCI-004558

Attach data tags containing organization-defined processing purposes to organization-defined elements of personally identifiable information.

Implementation Guidance

Determine if data tags containing [PT-03(01)_ODP[01]; processing purposes to be contained in data tags are defined] are attached to [PT-03(01)_ODP[02]; elements of personally identifiable information to be tagged are defined].

Validation Procedures

Examine: [SELECT FROM: Personally identifiable information processing and transparency policy and procedures; documented description of how data tags are used to identify personally identifiable information data elements and their authorized uses; data tag schema; data extracts with corresponding data tags; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with data tagging responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for authorizing the processing of personally identifiable information; mechanisms supporting and/or implementing data tagging].

The controls below (if any) were marked by NIST as being related to CCI-004558.