Navigate

PT-3(1)

PT-3(1): Data Tagging

Attach data tags containing the following purposes to [elements of personally identifiable information to be tagged are defined;]: [processing purposes to be contained in data tags are defined;].

Supplemental

Data tags support the tracking of processing purposes by conveying the purposes along with the relevant elements of personally identifiable information throughout the system. By conveying the processing purposes in a data tag along with the personally identifiable information as the information transits a system, a system owner or operator can identify whether a change in processing would be compatible with the identified and documented purposes. Data tags may also support the use of automated tools.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
DAF Baseline, Privacy (high), Privacy (moderate)

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to PT-3(1).

Control	Description
CA-6	a: Assign a senior official as the authorizing official for the system; b: Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems; c: Ensure that the authorizing official for the system, before commencing operations: 1: Accepts the use of common controls inherited by the system; and 2: Authorizes the system to operate; d: Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems; e: Update the authorizations [frequency at which to update the authorizations is defined;].
CM-12	a: Identify and document the location of [information for which the location is to be identified and documented is defined;] and the specific system components on which the information is processed and stored; b: Identify and document the users who have access to the system and system components where the information is processed and stored; and c: Document changes to the location (i.e., system or system components) where the information is processed and stored.
PM-5	Develop and update [the frequency at which to update the inventory of organizational systems is defined;] an inventory of organizational systems.
PM-22	Develop and document organization-wide policies and procedures for: a: Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; b: Correcting or deleting inaccurate or outdated personally identifiable information; c: Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and d: Appeals of adverse decisions on correction or deletion requests.
SC-16	Associate [one of ] with information exchanged between systems and between system components.
SC-43	a: Establish usage restrictions and implementation guidelines for the following system components: [the components for which usage restrictions and implementation guidance are to be established are defined;] ; and b: Authorize, monitor, and control the use of such components within the system.
SI-10	Check the validity of the following information inputs: [information inputs to the system requiring validity checks are defined;].
SI-15	Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [software programs and/or applications whose information output requires validation are defined;].
SI-19	a: Remove the following elements of personally identifiable information from datasets: [elements of personally identifiable information to be removed from datasets are defined;] ; and b: Evaluate [the frequency at which to evaluate the effectiveness of de-identification is defined;] for effectiveness of de-identification.

Enhancements

The controls below (if any) add on to the requirements of PT-3(1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to PT-3(1).

CCI	Definition
CCI-004558	Attach data tags containing organization-defined processing purposes to organization-defined elements of personally identifiable information.
CCI-004559	Defines the elements of personally identifiable information containing organization-defined processing purposes.