Navigate

DM-3

DM-3: Minimization of PII Used In Testing, Training, and Research

The organization:

DM-3a.: Develops policies and procedures that minimize the use of personally identifiable information (PII) for testing, training, and research; and

DM-3b.: Implements controls to protect PII used for testing, training, and research.

Supplemental

Organizations often use PII for testing new applications or information systems prior to deployment. Organizations also use PII for research purposes and for training. The use of PII in testing, research, and training increases risk of unauthorized disclosure or misuse of the information. If PII must be used, organizations take measures to minimize any associated risks and to authorize the use of and limit the amount of PII for these purposes. Organizations consult with the SAOP/CPO and legal counsel to ensure that the use of PII in testing, training, and research is compatible with the original purpose for which it was collected.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to DM-3.

Control	Description
No controls

Enhancements

The controls below (if any) add on to the requirements of DM-3.

Control	Description
DM-3 (1)	The organization, where feasible, uses techniques to minimize the risk to privacy of using PII for research, testing, or training.

Related CCIs

The CCIs below are tied to DM-3.

CCI	Definition
CCI-003507	The organization develops policies that minimize the use of personally identifiable information (PII) for testing.
CCI-003508	The organization develops policies that minimize the use of personally identifiable information (PII) for training.
CCI-003509	The organization develops policies that minimize the use of personally identifiable information (PII) for research.
CCI-003510	The organization develops procedures that minimize the use of personally identifiable information (PII) for testing.
CCI-003511	The organization develops procedures that minimize the use of personally identifiable information (PII) for training.
CCI-003512	The organization develops procedures that minimize the use of personally identifiable information (PII) for research.
CCI-003513	The organization implements controls to protect personally identifiable information (PII) used for testing.
CCI-003514	The organization implements controls to protect personally identifiable information (PII) used for training.
CCI-003515	The organization implements controls to protect personally identifiable information (PII) used for research.