---

id: "SI-18" title: "Personally Identifiable Information Quality Operations" family: "SI" family_name: "System and Information Integrity" sort_id: "si-18" priority: "P1" implementation_level: "system" enhancements: - si-18.1 - si-18.2 - si-18.3 - si-18.4 - si-18.5

---

Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle {{ insert: param, si-18_prm_1 }} ; and

Correct or delete inaccurate or outdated personally identifiable information.

Guidance

Personally identifiable information quality operations include the steps that organizations take to confirm the accuracy and relevance of personally identifiable information throughout the information life cycle. The information life cycle includes the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of personally identifiable information. Personally identifiable information quality operations include editing and validating addresses as they are collected or entered into systems using automated address verification look-up application programming interfaces. Checking personally identifiable information quality includes the tracking of updates or changes to data over time, which enables organizations to know how and what personally identifiable information was changed should erroneous information be identified. The measures taken to protect personally identifiable information quality are based on the nature and context of the personally identifiable information, how it is to be used, how it was obtained, and the potential de-identification methods employed. The measures taken to validate the accuracy of personally identifiable information used to make determinations about the rights, benefits, or privileges of individuals covered under federal programs may be more comprehensive than the measures used to validate personally identifiable information used for less sensitive purposes.

Assessment Objective: the accuracy of personally identifiable information across the information life cycle is checked {{ insert: param, si-18_odp.01 }};

Assessment Objective: the relevance of personally identifiable information across the information life cycle is checked {{ insert: param, si-18_odp.02 }};

Assessment Objective: the timeliness of personally identifiable information across the information life cycle is checked {{ insert: param, si-18_odp.03 }};

Assessment Objective: the completeness of personally identifiable information across the information life cycle is checked {{ insert: param, si-18_odp.04 }};

Assessment Objective: inaccurate or outdated personally identifiable information is corrected or deleted.

System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

documentation addressing personally identifiable information quality operations

quality reports

maintenance logs

system audit records

audit findings

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Organizational personnel responsible for performing personally identifiable information quality inspections

organizational personnel with information security responsibilities

organizational personnel with privacy responsibilities

Organizational processes for personally identifiable information quality inspection

automated mechanisms supporting and/or implementing personally identifiable information quality operations