Navigate

CCI-004573

CCI-004573 Definition

Provide notice to individuals about the processing of personally identifiable information is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if a notice to individuals about the processing of personally identifiable information is provided that is clear, easy-to-understand, and expresses information about personally identifiable information processing in plain language.

Validation Procedures

Examine: [SELECT FROM: Personally identifiable information processing and transparency policy and procedures; privacy notice; Privacy Act statements; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with user interface or user experience responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes and implementation support or mechanisms for providing notice to individuals regarding the processing of their personally identifiable information].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004573.

Control	Description
PT-5	Provide notice to individuals about the processing of personally identifiable information that: a: Is available to individuals upon first interacting with an organization, and subsequently at [the frequency at which a notice is provided to individuals after initial interaction with an organization is defined;]; b: Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language; c: Identifies the authority that authorizes the processing of personally identifiable information; d: Identifies the purposes for which personally identifiable information is to be processed; and e: Includes [information to be included with the notice about the processing of personally identifiable information is defined;].

Control

Description

PT-5

Provide notice to individuals about the processing of personally identifiable information that:

a: Is available to individuals upon first interacting with an organization, and subsequently at [the frequency at which a notice is provided to individuals after initial interaction with an organization is defined;];

b: Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language;

c: Identifies the authority that authorizes the processing of personally identifiable information;

d: Identifies the purposes for which personally identifiable information is to be processed; and

e: Includes [information to be included with the notice about the processing of personally identifiable information is defined;].