id: "SC-42(02)" title: "Authorized Use" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-42.02" priority: "P1" implementation_level: "organization" parent: "SC-42" enhancement: True
Statement
Employ the following measures so that data or information collected by {{ insert: param, sc-42.01_odp }} is only used for authorized purposes: {{ insert: param, sc-42.02_odp }}.
Guidance
Information collected by sensors for a specific authorized purpose could be misused for some unauthorized purpose. For example, GPS sensors that are used to support traffic navigation could be misused to track the movements of individuals. Measures to mitigate such activities include additional training to help ensure that authorized individuals do not abuse their authority and, in the case where sensor data is maintained by external parties, contractual restrictions on the use of such data.
Assessment Objective
{{ insert: param, sc-42.02_odp }} are employed so that data or information collected by {{ insert: param, sc-42.01_odp }} is only used for authorized purposes.
System and communications protection policy
access control policy and procedures
personally identifiable information processing policy
sensor capability and data collection
system design documentation
system configuration settings and associated documentation
system architecture
list of measures to be employed to that the ensure data or information collected by sensors is only used for authorized purposes
system audit records
system security plan
privacy plan
other relevant documents or records
System/network administrators
organizational personnel with information security and privacy responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for sensor capabilities
Mechanisms supporting and/or implementing measures to ensure that sensor information is only used for authorized purposes
sensor information collection capability for the system