PT-4(3)

Requirement

Implement [Assignment: organization-defined tools or mechanisms] for individuals to revoke consent to the processing of their personally identifiable information.

Discussion

Revocation of consent enables individuals to exercise control over their initial consent decision when circumstances change. Organizations consider usability factors in enabling easy-to-use revocation capabilities.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Personally identifiable information processing and transparency policy and procedures; consent revocation policies and procedures; consent revocation user interface or user experience; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with user interface or user experience responsibilities; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Organizational processes for consenting to the processing of personally identifiable information; tools or mechanisms for implementing consent revocation].

ID	Assessment Objectives
PT-04(03)	the <PT-04(03)_ODP tools or mechanisms> are implemented for individuals to revoke consent to the processing of their personally identifiable information.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!