id: "SC-07(24)" title: "Personally Identifiable Information" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-07.24" priority: "P1" implementation_level: "system" parent: "SC-07" enhancement: True
Statement
For systems that process personally identifiable information:
Apply the following processing rules to data elements of personally identifiable information: {{ insert: param, sc-07.24_odp }};
Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system;
Document each processing exception; and
Review and remove exceptions that are no longer supported.
Guidance
Managing the processing of personally identifiable information is an important aspect of protecting an individual’s privacy. Applying, monitoring for, and documenting exceptions to processing rules ensure that personally identifiable information is processed only in accordance with established privacy requirements.
Assessment Objective: {{ insert: param, sc-07.24_odp }} are applied to data elements of personally identifiable information on systems that process personally identifiable information;
Assessment Objective: permitted processing is monitored at the external interfaces to the systems that process personally identifiable information;
Assessment Objective: permitted processing is monitored at key internal boundaries within the systems that process personally identifiable information;
Assessment Objective: each processing exception is documented for systems that process personally identifiable information;
Assessment Objective: exceptions for systems that process personally identifiable information are reviewed;
Assessment Objective: exceptions for systems that process personally identifiable information that are no longer supported are removed.
System and communications protection policy
procedures addressing boundary protection
personally identifiable information processing policies
list of key internal boundaries of the system
system design documentation
system configuration settings and associated documentation
enterprise security and privacy architecture documentation
system audit records
system security plan
privacy plan
personally identifiable information inventory documentation
data mapping documentation
other relevant documents or records
System/network administrators
organizational personnel with information security and privacy responsibilities
system developer
organizational personnel with boundary protection responsibilities
Mechanisms implementing boundary protection capabilities