SI-18(3)

Requirement

Collect personally identifiable information directly from the individual.

Discussion

Individuals or their designated representatives can be sources of correct personally identifiable information. Organizations consider contextual factors that may incentivize individuals to provide correct data versus false data. Additional steps may be necessary to validate collected information based on the nature and context of the personally identifiable information, how it is to be used, and how it was obtained. The measures taken to validate the accuracy of personally identifiable information used to make determinations about the rights, benefits, or privileges of individuals under federal programs may be more comprehensive than the measures taken to validate less sensitive personally identifiable information.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; system configuration documentation; system audit records; user interface where personally identifiable information is collected; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for data collection; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Data collection mechanisms; automated mechanisms supporting and/or validating collection directly from the individual].

ID	Assessment Objectives
SI-18(03)	personally identifiable information is collected directly from the individual.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!