CCI-004560

Track processing purposes of personally identifiable information using organization-defined automated mechanisms.

Implementation Guidance

Determine if the processing purposes of personally identifiable information are tracked using [PT-03(02)_ODP; automated mechanisms for tracking the processing purposes of personally identifiable information are defined].

Validation Procedures

Examine: [SELECT FROM: Personally identifiable information processing and transparency policy and procedures; data extracts with corresponding data tags; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for managing the enforcement of authorized processing of personally identifiable information; automated tracking mechanisms].

The controls below (if any) were marked by NIST as being related to CCI-004560.