SI-18 Personally Identifiable Information Quality Operations
a. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle si-18_prm_1 ; and
b. Correct or delete inaccurate or outdated personally identifiable information.
| Parameter ID | Definition |
|---|---|
| si-18_prm_1 | organization-defined frequency |
| si-18_odp.01 | frequency |
| si-18_odp.02 | frequency |
| si-18_odp.03 | frequency |
| si-18_odp.04 | frequency |
Baselines
- L
- M
- H
- P
Guidance
Personally identifiable information quality operations include the steps that organizations take to confirm the accuracy and relevance of personally identifiable information throughout the information life cycle. The information life cycle includes the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of personally identifiable information. Personally identifiable information quality operations include editing and validating addresses as they are collected or entered into systems using automated address verification look-up application programming interfaces. Checking personally identifiable information quality includes the tracking of updates or changes to data over time, which enables organizations to know how and what personally identifiable information was changed should erroneous information be identified. The measures taken to protect personally identifiable information quality are based on the nature and context of the personally identifiable information, how it is to be used, how it was obtained, and the potential de-identification methods employed. The measures taken to validate the accuracy of personally identifiable information used to make determinations about the rights, benefits, or privileges of individuals covered under federal programs may be more comprehensive than the measures used to validate personally identifiable information used for less sensitive purposes.
References 3
- OMB M-19-15 Office of Management and Budget Memorandum M-19-15, *Improving Implementation of the Information Quality Act* , April 2019.
- SP 800-188 Garfinkel S (2016) De-Identifying Government Datasets. (National Institute of Standards and Technology, Gaithersburg, MD), Second Draft NIST Special Publication (SP) 800-188.
- IR 8112 Grassi P, Lefkovitz N, Nadeau E, Galluzzo R, Dinh, A (2018) Attribute Metadata: A Proposed Schema for Evaluating Federated Attributes. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8112.
Control Enhancements 5
- SI-18(01) Automation Support L M H P
- SI-18(02) Data Tags L M H P
- SI-18(03) Collection L M H P
- SI-18(04) Individual Requests L M H P
- SI-18(05) Notice of Correction or Deletion L M H P
Related controls 4
- PM-22 Personally Identifiable Information Quality Management L M H P
- PM-24 Data Integrity Board L M H P
- PT-02 Authority to Process Personally Identifiable Information L M H P
- SI-04 System Monitoring L M H P