SI-19(3)

Requirement

Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.

Discussion

Prior to releasing a dataset, a data custodian considers the intended uses of the dataset and determines if it is necessary to release personally identifiable information. If the personally identifiable information is not necessary, the information can be removed using de-identification techniques.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; procedures for minimizing the release of personally identifiable information; system configuration; data release mechanisms; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for de-identifying the dataset; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements from a dataset].

ID	Assessment Objectives
SI-19(03)	personally identifiable information elements are removed from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!