---

id: "SA-15(12)" title: "Minimize Personally Identifiable Information" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-15.12" priority: "P1" implementation_level: "organization" parent: "SA-15" enhancement: True

---

Statement

Require the developer of the system or system component to minimize the use of personally identifiable information in development and test environments.

Guidance

Organizations can minimize the risk to an individual’s privacy by using techniques such as de-identification or synthetic data. Limiting the use of personally identifiable information in development and test environments helps reduce the level of privacy risk created by a system.

Assessment Objective

the developer of the system or system component is required to minimize the use of personally identifiable information in development and test environments.

System and services acquisition policy

system and services acquisition procedures

procedures addressing the development process

procedures addressing the minimization of personally identifiable information in testing, training, and research

personally identifiable information processing policy

procedures addressing the authority to test with personally identifiable information

standards and tools

solicitation documentation

service level agreements

acquisition contracts for the system or services

system security plan

privacy plan

other relevant documents or records

Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

system developer

Organizational processes for the minimization of personally identifiable information in development and test environments

mechanisms to facilitate the minimization of personally identifiable information in development and test environments