PM-22 Personally Identifiable Information Quality Management. Develop and document organization-wide policies and procedures for: Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; Correcting or deleting inaccurate
Personally Identifiable Information Quality Management. Develop and document organization-wide policies and procedures for: Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable i.
system holds itEvidence a system already holds
- Monitoring records showing quality management practices are themselves reviewed · SIEM / log platform
periodic reviewEvidence produced at each review
- Records of quality reviews performed across the information life cycle · Document repository
governing documentDocuments that govern the control
- Organisation-wide policies and procedures for reviewing personally identifiable information for accuracy, relevance, timeliness and completeness · Policy repository / GRC workspace
- Procedures for correcting or deleting inaccurate or outdated personally identifiable information · Policy repository / GRC workspace
- Sample notices of correction or deletion issued to recipients who received the flawed information · Document repository
First move
Common gaps auditors find
- Correction applied in the master record while downstream copies and prior recipients keep the inaccurate version
- Quality checked at collection only, not across the life cycle as the control requires
- No disseminated correction notice, so third parties continue acting on wrong information
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-21 Accounting of Disclosures. Develop and maintain an accurate accounting of disclosures of personally identifiable information, including: Date, nature, and purpose of each disclosure; and Name and address, or other contact information of the individual · PM-23 Data Governance Body. Establish a Data Governance Body consisting of [organization-defined] with [organization-defined]