Navigate

PM-5(1)

PM-5(1): Inventory of Personally Identifiable Information

Establish, maintain, and update [the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information is defined;] an inventory of all systems, applications, and projects that process personally identifiable information.

Supplemental

An inventory of systems, applications, and projects that process personally identifiable information supports the mapping of data actions, providing individuals with privacy notices, maintaining accurate personally identifiable information, and limiting the processing of personally identifiable information when such information is not needed for operational purposes. Organizations may use this inventory to ensure that systems only process the personally identifiable information for authorized purposes and that this processing is still relevant and necessary for the purpose specified therein.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
Privacy (accountability), Privacy (high), Privacy (low), Privacy (moderate), Privacy Control Baseline (CNSSI 1253)

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to PM-5(1).

Control	Description
AC-3	Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
CM-8	a: Develop and document an inventory of system components that: 1: Accurately reflects the system; 2: Includes all components within the system; 3: Does not include duplicate accounting of components or components assigned to any other system; 4: Is at the level of granularity deemed necessary for tracking and reporting; and 5: Includes the following information to achieve system component accountability: [information deemed necessary to achieve effective system component accountability is defined;] ; and b: Review and update the system component inventory [frequency at which to review and update the system component inventory is defined;].
CM-12	a: Identify and document the location of [information for which the location is to be identified and documented is defined;] and the specific system components on which the information is processed and stored; b: Identify and document the users who have access to the system and system components where the information is processed and stored; and c: Document changes to the location (i.e., system or system components) where the information is processed and stored.
CM-13	Develop and document a map of system data actions.
PL-8	a: Develop security and privacy architectures for the system that: 1: Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information; 2: Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals; 3: Describe how the architectures are integrated into and support the enterprise architecture; and 4: Describe any assumptions about, and dependencies on, external systems and services; b: Review and update the architectures [frequency for review and update to reflect changes in the enterprise architecture;] to reflect changes in the enterprise architecture; and c: Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions.
PM-22	Develop and document organization-wide policies and procedures for: a: Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; b: Correcting or deleting inaccurate or outdated personally identifiable information; c: Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and d: Appeals of adverse decisions on correction or deletion requests.
PT-3	a: Identify and document the [the purpose(s) for processing personally identifiable information is/are defined;] for processing personally identifiable information; b: Describe the purpose(s) in the public privacy notices and policies of the organization; c: Restrict the [the processing of personally identifiable information to be restricted is defined;] of personally identifiable information to only that which is compatible with the identified purpose(s); and d: Monitor changes in processing personally identifiable information and implement [mechanisms to be implemented for ensuring any changes in the processing of personally identifiable information are made in accordance with requirements are defined;] to ensure that any changes are made in accordance with [requirements for changing the processing of personally identifiable information are defined;].
PT-5	Provide notice to individuals about the processing of personally identifiable information that: a: Is available to individuals upon first interacting with an organization, and subsequently at [the frequency at which a notice is provided to individuals after initial interaction with an organization is defined;]; b: Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language; c: Identifies the authority that authorizes the processing of personally identifiable information; d: Identifies the purposes for which personally identifiable information is to be processed; and e: Includes [information to be included with the notice about the processing of personally identifiable information is defined;].
SI-12	Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.
SI-18	a: Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [one of ] ; and b: Correct or delete inaccurate or outdated personally identifiable information.

Enhancements

The controls below (if any) add on to the requirements of PM-5(1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to PM-5(1).

CCI	Definition
CCI-004331	Establish an inventory of all systems, applications, and projects that process personally identifiable information.
CCI-004332	Maintain an inventory of all systems, applications, and projects that process personally identifiable information.
CCI-004333	Update on an organization-defined frequency, an inventory of all systems, applications, and projects that process personally identifiable information.
CCI-004334	Defines the frequency of which an inventory of all systems, applications, and projects that process personally identifiable information will be updated.