id: "PE-08(03)" title: "Limit Personally Identifiable Information Elements" family: "PE" family_name: "Physical and Environmental Protection" sort_id: "pe-08.03" priority: "P2" implementation_level: "organization" parent: "PE-08" enhancement: True
Statement
Limit personally identifiable information contained in visitor access records to the following elements identified in the privacy risk assessment: {{ insert: param, pe-08.03_odp }}.
Guidance
Organizations may have requirements that specify the contents of visitor access records. Limiting personally identifiable information in visitor access records when such information is not needed for operational purposes helps reduce the level of privacy risk created by a system.
Assessment Objective
personally identifiable information contained in visitor access records is limited to {{ insert: param, pe-08.03_odp }} identified in the privacy risk assessment.
Physical and environmental protection policy
personally identifiable information processing policy
privacy risk assessment documentation
privacy impact assessment
visitor access records
personally identifiable information inventory
system security plan
privacy plan
other relevant documents or records
Organizational personnel with visitor access records responsibilities
organizational personnel with information security and privacy responsibilities
Organizational processes for maintaining and reviewing visitor access records