id: "SC-42(05)" title: "Collection Minimization" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-42.05" priority: "P1" implementation_level: "organization" parent: "SC-42" enhancement: True
Statement
Employ {{ insert: param, sc-42.05_odp }} that are configured to minimize the collection of information about individuals that is not needed.
Guidance
Although policies to control for authorized use can be applied to information once it is collected, minimizing the collection of information that is not needed mitigates privacy risk at the system entry point and mitigates the risk of policy control failures. Sensor configurations include the obscuring of human features, such as blurring or pixelating flesh tones.
Assessment Objective
the {{ insert: param, sc-42.05_odp }} configured to minimize the collection of information about individuals that is not needed are employed.
System and communications protection policy
access control policy and procedures
personally identifiable information processing policy
sensor capability and data collection policy and procedures
system design documentation
system configuration settings and associated documentation
privacy risk assessment documentation
privacy impact assessments
system architecture
list of information being collected by sensors
list of sensor configurations that minimize the collection of personally identifiable information (e.g., obscure human features)
system audit records
system security plan
privacy plan
other relevant documents or records
System/network administrators
organizational personnel with information security and privacy responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for sensor capabilities
Mechanisms supporting and/or implementing measures to facilitate the review of information that is being collected by sensors
sensor information collection capabilities for the system