PT-2(1)

Requirement

Attach data tags containing [Assignment: organization-defined authorized processing] to [Assignment: organization-defined elements of personally identifiable information].

Discussion

Data tags support the tracking and enforcement of authorized processing by conveying the types of processing that are authorized along with the relevant elements of personally identifiable information throughout the system. Data tags may also support the use of automated tools.

Related NIST 800-53 ID

AC-16;CA-6;CM-12;PM-5;PM-22;PT-4;SC-16;SC-43;SI-10;SI-15;SI-19

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Personally identifiable information processing and transparency policy and procedures including procedures addressing data tagging; data tag definitions; documented requirements for use and monitoring of data tagging; data extracts with corresponding data tags; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Organizational processes for authorizing the processing of personally identifiable information; organizational processes for data tagging; mechanisms for applying and monitoring data tagging; mechanisms supporting and/or implementing the restriction of personally identifiable information processing].

ID	Assessment Objectives
PT-02(01)	data tags containing <PT-02(01)_ODP[01] authorized processing> are attached to <PT-02(01)_ODP[02] elements of personally identifiable information>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!