SI-19(7)

Requirement

Perform de-identification using validated algorithms and software that is validated to implement the algorithms.

Discussion

Algorithms that appear to remove personally identifiable information from a dataset may in fact leave information that is personally identifiable or data that is re-identifiable. Software that is claimed to implement a validated algorithm may contain bugs or implement a different algorithm. Software may de-identify one type of data, such as integers, but not de-identify another type of data, such as floating point numbers. For these reasons, de-identification is performed using algorithms and software that are validated.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; system configuration; de-identified datasets; algorithm and software validation tools; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for de-identifying the dataset; organizational personnel with information security and privacy responsibilities].

ID	Assessment Objectives
SI-19(07)[01]	de-identification is performed using validated algorithms;
SI-19(07)[02]	de-identification is performed using software that is validated to implement the algorithms.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!