Question 1

What evidence do auditors ask for on SI-18 Personally Identifiable Information Quality Operations. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [organization-defined] ; and Correct or delete inaccurate or outdated personally identifiable information?

Accepted Answer

Records of accuracy, relevance, timeliness and completeness checks on personally identifiable information at the defined frequency; The checking method and the thresholds or rules applied; Correction and deletion records for inaccurate or outdated personally identifiable information; Evidence checks span the information life cycle rather than the point of collection only; Quality reports showing trend and the action taken on recurring defects.

Question 2

Can SI-18 be evidenced continuously rather than by periodic review?

Accepted Answer

This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.

Question 3

What is the most common gap auditors find on SI-18?

Accepted Answer

Validation at entry only, so information that ages out of accuracy is never re-checked

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet