id: "SC-42(04)" title: "Notice of Collection" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-42.04" priority: "P1" implementation_level: "organization" parent: "SC-42" enhancement: True
Statement
Employ the following measures to facilitate an individual’s awareness that personally identifiable information is being collected by {{ insert: param, sc-42.04_odp.02 }}: {{ insert: param, sc-42.04_odp.01 }}.
Guidance
Awareness that organizational sensors are collecting data enables individuals to more effectively engage in managing their privacy. Measures can include conventional written notices and sensor configurations that make individuals directly or indirectly aware through other devices that the sensor is collecting information. The usability and efficacy of the notice are important considerations.
Assessment Objective
{{ insert: param, sc-42.04_odp.01 }} are employed to facilitate an individual’s awareness that personally identifiable information is being collected by {{ insert: param, sc-42.04_odp.02 }}
System and communications protection policy
access control policy and procedures
personally identifiable information processing policy
sensor capability and data collection policy and procedures
system design documentation
system configuration settings and associated documentation
privacy risk assessment documentation
privacy impact assessments
system architecture
list of measures to be employed to ensure that individuals are aware that personally identifiable information is being collected by sensors
examples of notifications provided to individuals that personally identifiable information is being collected by sensors
system audit records
system security plan
privacy plan
other relevant documents or records
System/network administrators
organizational personnel with information security and privacy responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for sensor capabilities
Mechanisms supporting and/or implementing measures to facilitate an individual’s awareness that personally identifiable information is being collected by sensors
sensor information collection capabilities for the system