Navigate

PT-2(2)

PT-2(2): Automation

Manage enforcement of the authorized processing of personally identifiable information using [automated mechanisms used to manage enforcement of the authorized processing of personally identifiable information are defined;].

Supplemental

Automated mechanisms augment verification that only authorized processing is occurring.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
DAF Baseline

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to PT-2(2).

Control	Description
CA-6	a: Assign a senior official as the authorizing official for the system; b: Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems; c: Ensure that the authorizing official for the system, before commencing operations: 1: Accepts the use of common controls inherited by the system; and 2: Authorizes the system to operate; d: Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems; e: Update the authorizations [frequency at which to update the authorizations is defined;].
CM-12	a: Identify and document the location of [information for which the location is to be identified and documented is defined;] and the specific system components on which the information is processed and stored; b: Identify and document the users who have access to the system and system components where the information is processed and stored; and c: Document changes to the location (i.e., system or system components) where the information is processed and stored.
PM-5	Develop and update [the frequency at which to update the inventory of organizational systems is defined;] an inventory of organizational systems.
PM-22	Develop and document organization-wide policies and procedures for: a: Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; b: Correcting or deleting inaccurate or outdated personally identifiable information; c: Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and d: Appeals of adverse decisions on correction or deletion requests.
PT-4	Implement [the tools or mechanisms to be implemented for individuals to consent to the processing of their personally identifiable information are defined;] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.
SC-16	Associate [one of ] with information exchanged between systems and between system components.
SC-43	a: Establish usage restrictions and implementation guidelines for the following system components: [the components for which usage restrictions and implementation guidance are to be established are defined;] ; and b: Authorize, monitor, and control the use of such components within the system.
SI-10	Check the validity of the following information inputs: [information inputs to the system requiring validity checks are defined;].
SI-15	Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [software programs and/or applications whose information output requires validation are defined;].
SI-19	a: Remove the following elements of personally identifiable information from datasets: [elements of personally identifiable information to be removed from datasets are defined;] ; and b: Evaluate [the frequency at which to evaluate the effectiveness of de-identification is defined;] for effectiveness of de-identification.

Enhancements

The controls below (if any) add on to the requirements of PT-2(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to PT-2(2).

CCI	Definition
CCI-004547	Manage enforcement of the authorized processing of personally identifiable information using organization-defined automated mechanisms.
CCI-004548	Defines the automated mechanisms for managing enforcement of the authorized processing of personally identifiable information.