---

id: "SI-18(03)" title: "Collection" family: "SI" family_name: "System and Information Integrity" sort_id: "si-18.03" priority: "P1" implementation_level: "system" parent: "SI-18" enhancement: True

---

Statement

Collect personally identifiable information directly from the individual.

Guidance

Individuals or their designated representatives can be sources of correct personally identifiable information. Organizations consider contextual factors that may incentivize individuals to provide correct data versus false data. Additional steps may be necessary to validate collected information based on the nature and context of the personally identifiable information, how it is to be used, and how it was obtained. The measures taken to validate the accuracy of personally identifiable information used to make determinations about the rights, benefits, or privileges of individuals under federal programs may be more comprehensive than the measures taken to validate less sensitive personally identifiable information.

Assessment Objective

personally identifiable information is collected directly from the individual.

System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

system configuration documentation

system audit records

user interface where personally identifiable information is collected

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Organizational personnel responsible for data collection

organizational personnel with information security and privacy responsibilities

Data collection mechanisms

automated mechanisms supporting and/or validating collection directly from the individual