id: "CM-13" title: "Data Action Mapping" family: "CM" family_name: "Configuration Management" sort_id: "cm-13" priority: "P1" implementation_level: "organization"
Statement
Develop and document a map of system data actions.
Guidance
Data actions are system operations that process personally identifiable information. The processing of such information encompasses the full information life cycle, which includes collection, generation, transformation, use, disclosure, retention, and disposal. A map of system data actions includes discrete data actions, elements of personally identifiable information being processed in the data actions, system components involved in the data actions, and the owners or operators of the system components. Understanding what personally identifiable information is being processed (e.g., the sensitivity of the personally identifiable information), how personally identifiable information is being processed (e.g., if the data action is visible to the individual or is processed in another part of the system), and by whom (e.g., individuals may have different privacy perceptions based on the entity that is processing the personally identifiable information) provides a number of contextual factors that are important to assessing the degree of privacy risk created by the system. Data maps can be illustrated in different ways, and the level of detail may vary based on the mission and business needs of the organization. The data map may be an overlay of any system design artifact that the organization is using. The development of this map may necessitate coordination between the privacy and security programs regarding the covered data actions and the components that are identified as part of the system.
Assessment Objective
a map of system data actions is developed and documented.
Configuration management policy
procedures for identification and documentation of information location
procedures for mapping data actions
configuration management plan
system security plan
privacy plan
system design documentation
PII inventory documentation
data mapping documentation
change control records
system component inventory
other relevant documents or records
Organizational personnel with responsibilities for managing information location
organizational personnel responsible for data action mapping
organizational personnel with information security and privacy responsibilities
system/network administrators
system developers
Organizational processes governing information location
mechanisms supporting or implementing data action mapping