SI-19(5)

Requirement

Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.

Discussion

Many types of statistical analyses can result in the disclosure of information about individuals even if only summary information is provided. For example, if a school that publishes a monthly table with the number of minority students enrolled, reports that it has 10-19 such students in January, and subsequently reports that it has 20-29 such students in March, then it can be inferred that the student who enrolled in February was a minority.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; system configuration; de-identified datasets; statistical analysis report; tools for the control of statistical disclosure; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for de-identifying the dataset; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Automated mechanisms supporting and/or implementing the control of statistical disclosure].

ID	Assessment Objectives
SI-19(05)[02]	contingency tables are manipulated so that no individual or organization is identifiable in the results of the analysis;
SI-19(05)[03]	statistical findings are manipulated so that no individual or organization is identifiable in the results of the analysis.
SI-19(05)[01]	numerical data is manipulated so that no individual or organization is identifiable in the results of the analysis;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!