Navigate

CCI-004595

CCI-004595 Definition

When a system processes Social Security numbers: do not deny any individuals any right, benefit, or privilege provided by law because of such individuals' refusal to disclose his or her Social Security number.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if when a system processes Social Security numbers, individual rights, benefits, or privileges provided by law are not denied because of an individual's refusal to disclose their Social Security number.

Validation Procedures

Examine: [SELECT FROM: Personally identifiable information processing and transparency policy and procedures; privacy notice; Privacy Act system of records; privacy notice; separate notice regarding the use of Social Security numbers; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for identifying, reviewing, and taking action to control the unnecessary use of Social Security numbers; implementation of an alternative to Social Security numbers as identifiers].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004595.

Control	Description
PT-7(1)	When a system processes Social Security numbers: (a): Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier; (b): Do not deny any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his or her Social Security number; and (c): Inform any individual who is asked to disclose his or her Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.

Control

Description

PT-7(1)

When a system processes Social Security numbers:

(a): Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier;

(b): Do not deny any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his or her Social Security number; and

(c): Inform any individual who is asked to disclose his or her Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.