CCI-004601

When a system or organization processes information for the purpose of conducting a matching program: independently verify the information produced by the matching program before taking adverse action against an individual, if required.

Implementation Guidance

Determine if the information produced by the matching program is independently verified before taking adverse action against an individual, if required, when a system or organization processes information for the purpose of conducting a matching program.

Validation Procedures

Examine: [SELECT FROM: Personally identifiable information processing and transparency policy and procedures; privacy notice; Privacy Act system of records; Federal Register notices; Data Integrity Board determinations; contracts; information sharing agreements; memoranda of understanding; governing requirements; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for supporting and/or implementing personally identifiable information processing; matching program].

The controls below (if any) were marked by NIST as being related to CCI-004601.