SI-19(1)

Requirement

De-identify the dataset upon collection by not collecting personally identifiable information.

Discussion

If a data source contains personally identifiable information but the information will not be used, the dataset can be de-identified when it is created by not collecting the data elements that contain the personally identifiable information. For example, if an organization does not intend to use the social security number of an applicant, then application forms do not ask for a social security number.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; procedures for minimizing the collection of personally identifiable information; system configuration; data collection mechanisms; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for de-identifying the dataset; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Automated mechanisms preventing the collection of personally identifiable information].

ID	Assessment Objectives
SI-19(01)	the dataset is de-identified upon collection by not collecting personally identifiable information.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!