Navigate

SA-15(12)

SA-15(12): Minimize Personally Identifiable Information

Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.

Supplemental

Organizations can minimize the risk to an individual’s privacy by using techniques such as de-identification or synthetic data. Limiting the use of personally identifiable information in development and test environments helps reduce the level of privacy risk created by a system.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
Privacy (high), Privacy (low), Privacy (moderate)

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to SA-15(12).

Control	Description
PM-25	a: Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research; b: Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes; c: Authorize the use of personally identifiable information when such information is required for internal testing, training, and research; and d: Review and update policies and procedures [one of ].
SA-3	a: Acquire, develop, and manage the system using [system development life cycle is defined;] that incorporates information security and privacy considerations; b: Define and document information security and privacy roles and responsibilities throughout the system development life cycle; c: Identify individuals having information security and privacy roles and responsibilities; and d: Integrate the organizational information security and privacy risk management process into system development life cycle activities.
SA-8	Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [one of ].

Enhancements

The controls below (if any) add on to the requirements of SA-15(12).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-15(12).

CCI	Definition
CCI-004834	Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.