Navigate

PT-3(2)

PT-3(2): Automation

Track processing purposes of personally identifiable information using [automated mechanisms for tracking the processing purposes of personally identifiable information are defined;].

Supplemental

Automated mechanisms augment tracking of the processing purposes.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
DAF Baseline

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to PT-3(2).

Control	Description
CA-6	a: Assign a senior official as the authorizing official for the system; b: Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems; c: Ensure that the authorizing official for the system, before commencing operations: 1: Accepts the use of common controls inherited by the system; and 2: Authorizes the system to operate; d: Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems; e: Update the authorizations [frequency at which to update the authorizations is defined;].
CM-12	a: Identify and document the location of [information for which the location is to be identified and documented is defined;] and the specific system components on which the information is processed and stored; b: Identify and document the users who have access to the system and system components where the information is processed and stored; and c: Document changes to the location (i.e., system or system components) where the information is processed and stored.
PM-5	Develop and update [the frequency at which to update the inventory of organizational systems is defined;] an inventory of organizational systems.
PM-22	Develop and document organization-wide policies and procedures for: a: Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; b: Correcting or deleting inaccurate or outdated personally identifiable information; c: Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and d: Appeals of adverse decisions on correction or deletion requests.
SC-16	Associate [one of ] with information exchanged between systems and between system components.
SC-43	a: Establish usage restrictions and implementation guidelines for the following system components: [the components for which usage restrictions and implementation guidance are to be established are defined;] ; and b: Authorize, monitor, and control the use of such components within the system.
SI-10	Check the validity of the following information inputs: [information inputs to the system requiring validity checks are defined;].
SI-15	Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [software programs and/or applications whose information output requires validation are defined;].
SI-19	a: Remove the following elements of personally identifiable information from datasets: [elements of personally identifiable information to be removed from datasets are defined;] ; and b: Evaluate [the frequency at which to evaluate the effectiveness of de-identification is defined;] for effectiveness of de-identification.

Enhancements

The controls below (if any) add on to the requirements of PT-3(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to PT-3(2).

CCI	Definition
CCI-004560	Track processing purposes of personally identifiable information using organization-defined automated mechanisms.