PT-7 Specific Categories of Personally Identifiable Information. Apply [organization-defined] for specific categories of personally identifiable information
Specific Categories of Personally Identifiable Information. Apply [organization-defined] for specific categories of personally identifiable information.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence those conditions are enforced technically or procedurally · Data governance / DLP tooling
- Records of exceptions and their approval · Data governance / DLP tooling
governing documentDocuments that govern the control
- Identification of the specific categories of personally identifiable information in scope, such as social security numbers or criminal history · Policy repository / GRC workspace
- The defined processing conditions or additional safeguards applied to each category · Policy repository / GRC workspace
- Agreements, contracts and information sharing arrangements reflecting the category specific requirements · Vendor register / contract repository
First move
Common gaps auditors find
- Category identified in policy but not labelled in the data, so no control can act on it
- Enhanced safeguards applied in the primary system while extracts and reports carry the same category unprotected
- Third party agreements silent on the special category conditions the organisation applies internally
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPT-6 System of Records Notice. For systems that process information that will be maintained in a Privacy Act system of records: Draft system of records notices in accordance with OMB guidance and submit new and · PT-8 Computer Matching Requirements. When a system or organization processes information for the purpose of conducting a matching program: Obtain approval from the Data Integrity Board to conduct the matching program; Develop and enter into