Navigate

PT-2(1)

PT-2(1): Data Tagging

Attach data tags containing [the authorized processing of personally identifiable information is defined;] to [elements of personally identifiable information to be tagged are defined;].

Supplemental

Data tags support the tracking and enforcement of authorized processing by conveying the types of processing that are authorized along with the relevant elements of personally identifiable information throughout the system. Data tags may also support the use of automated tools.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
DAF Baseline, Privacy (high), Privacy (moderate)

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to PT-2(1).

Control	Description
AC-16	a: Provide the means to associate [one of ] with [one of ] for information in storage, in process, and/or in transmission; b: Ensure that the attribute associations are made and retained with the information; c: Establish the following permitted security and privacy attributes from the attributes defined in [AC-16a](#ac-16_smt.a) for [one of ]: [one of ]; d: Determine the following permitted attribute values or ranges for each of the established attributes: [attribute values or ranges for established attributes are defined;]; e: Audit changes to attributes; and f: Review [one of ] for applicability [one of ].
CA-6	a: Assign a senior official as the authorizing official for the system; b: Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems; c: Ensure that the authorizing official for the system, before commencing operations: 1: Accepts the use of common controls inherited by the system; and 2: Authorizes the system to operate; d: Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems; e: Update the authorizations [frequency at which to update the authorizations is defined;].
CM-12	a: Identify and document the location of [information for which the location is to be identified and documented is defined;] and the specific system components on which the information is processed and stored; b: Identify and document the users who have access to the system and system components where the information is processed and stored; and c: Document changes to the location (i.e., system or system components) where the information is processed and stored.
PM-5	Develop and update [the frequency at which to update the inventory of organizational systems is defined;] an inventory of organizational systems.
PM-22	Develop and document organization-wide policies and procedures for: a: Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; b: Correcting or deleting inaccurate or outdated personally identifiable information; c: Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and d: Appeals of adverse decisions on correction or deletion requests.
PT-4	Implement [the tools or mechanisms to be implemented for individuals to consent to the processing of their personally identifiable information are defined;] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.
SC-16	Associate [one of ] with information exchanged between systems and between system components.
SC-43	a: Establish usage restrictions and implementation guidelines for the following system components: [the components for which usage restrictions and implementation guidance are to be established are defined;] ; and b: Authorize, monitor, and control the use of such components within the system.
SI-10	Check the validity of the following information inputs: [information inputs to the system requiring validity checks are defined;].
SI-15	Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [software programs and/or applications whose information output requires validation are defined;].
SI-19	a: Remove the following elements of personally identifiable information from datasets: [elements of personally identifiable information to be removed from datasets are defined;] ; and b: Evaluate [the frequency at which to evaluate the effectiveness of de-identification is defined;] for effectiveness of de-identification.

Enhancements

The controls below (if any) add on to the requirements of PT-2(1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to PT-2(1).

CCI	Definition
CCI-004544	Attach data tags containing organization-defined authorized processing to organization-defined elements of personally identifiable information.
CCI-004545	Defines the authorized processing which will attach data tags to organization-defined elements of personally identifiable information.
CCI-004546	Defines the elements of personally identifiable information containing organization-defined authorized processing.