SI-18(2)

Requirement

Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.

Discussion

Data tagging personally identifiable information includes tags that note processing permissions, authority to process, de-identification, impact level, information life cycle stage, and retention or last updated dates. Employing data tags for personally identifiable information can support the use of automation tools to correct or delete relevant personally identifiable information.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; procedures addressing data tagging; personally identifiable information inventory; system audit records; audit findings; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for tagging data; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Data tagging mechanisms; automated mechanisms supporting and/or implementing data tagging].

ID	Assessment Objectives
SI-18(02)	data tags are employed to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!