SC-7(24)

Discussion

Managing the processing of personally identifiable information is an important aspect of protecting an individual's privacy. Applying, monitoring for, and documenting exceptions to processing rules ensure that personally identifiable information is processed only in accordance with established privacy requirements.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing boundary protection; personally identifiable information processing policies; list of key internal boundaries of the system; system design documentation; system configuration settings and associated documentation; enterprise security and privacy architecture documentation; system audit records; system security plan; privacy plan; personally identifiable information inventory documentation; data mapping documentation; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security and privacy responsibilities; system developer; organizational personnel with boundary protection responsibilities].

ID	Assessment Objectives
SC-07(24)(c)	each processing exception is documented for systems that process personally identifiable information;
SC-07(24)(d)[01]	exceptions for systems that process personally identifiable information are reviewed;
SC-07(24)(d)[02]	exceptions for systems that process personally identifiable information that are no longer supported are removed.
SC-07(24)(a)	<SC-07(24)_ODP processing rules> are applied to data elements of personally identifiable information on systems that process personally identifiable information;
SC-07(24)(b)[01]	permitted processing is monitored at the external interfaces to the systems that process personally identifiable information;
SC-07(24)(b)[02]	permitted processing is monitored at key internal boundaries within the systems that process personally identifiable information;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!