PM-22 PM · Program Management

Personally Identifiable Information Quality Management

LOW MODERATE HIGH
1 Overlay 2 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Develop and document organization-wide policies and procedures for:

Discussion (NIST Supplemental Guidance)

Personally identifiable information quality management includes steps that organizations take to confirm the accuracy and relevance of personally identifiable information throughout the information life cycle. The information life cycle includes the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposition of personally identifiable information. Organizational policies and procedures for personally identifiable information quality management are important because inaccurate or outdated personally identifiable information maintained by organizations may cause problems for individuals. Organizations consider the quality of personally identifiable information involved in business functions where inaccurate information may result in adverse decisions or the denial of benefits and services, or the disclosure of the information may cause stigmatization. Correct information, in certain circumstances, can cause problems for individuals that outweigh the benefits of organizations maintaining the information. Organizations consider creating policies and procedures for the removal of such information. The senior agency official for privacy ensures that practical means and mechanisms exist and are accessible for individuals or their authorized representatives to seek the correction or deletion of personally identifiable information. Processes for correcting or deleting data are clearly defined and publicly available. Organizations use discretion in determining whether data is to be deleted or corrected based on the scope of requests, the changes sought, and the impact of the changes. Additionally, processes include the provision of responses to individuals of decisions to deny requests for correction or deletion. The responses include the reasons for the decisions, a means to record individual objections to the decisions, and a means of requesting reviews of the initial determinations. Organizations notify individuals or their designated representatives when their personally identifiable information is corrected or deleted to provide transparency and confirm the completed action. Due to the complexity of data flows and storage, other entities may need to be informed of the correction or deletion. Notice supports the consistent correction and deletion of personally identifiable information across the data ecosystem.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for PM-22 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. organization-wide policies for personally identifiable information quality management are developed and documented;
  2. organization-wide procedures for personally identifiable information quality management are developed and documented;
  3. the policies address reviewing the accuracy of personally identifiable information across the information life cycle;
  4. the policies address reviewing the relevance of personally identifiable information across the information life cycle;
  5. the policies address reviewing the timeliness of personally identifiable information across the information life cycle;
  6. the policies address reviewing the completeness of personally identifiable information across the information life cycle;
  7. the procedures address reviewing the accuracy of personally identifiable information across the information life cycle;
  8. the procedures address reviewing the relevance of personally identifiable information across the information life cycle;
  9. the procedures address reviewing the timeliness of personally identifiable information across the information life cycle;
  10. the procedures address reviewing the completeness of personally identifiable information across the information life cycle;
  11. the policies address correcting or deleting inaccurate or outdated personally identifiable information;
  12. the procedures address correcting or deleting inaccurate or outdated personally identifiable information;
  13. the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
  14. the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
  15. the policies address appeals of adverse decisions on correction or deletion requests;
  16. the procedures address appeals of adverse decisions on correction or deletion requests.

Examine

[SELECT FROM: Privacy program plan; policies and procedures addressing personally identifiable information quality management, information life cycle documentation, and sample notices of correction or deletion; records of monitoring PII quality management practices; documentation of reviews and updates of policies and procedures].

Interview

[SELECT FROM: Organizational personnel with privacy program information dissemination responsibilities; organizational personnel with privacy responsibilities].

Test

[SELECT FROM: [Organizational processes for data quality and personally identifiable information quality management procedures; mechanisms supporting and/or implementing quality management requirements].

Overlays

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Not applicable at this tier.

MODERATE

Not applicable at this tier.

HIGH

  • Base control: Added (beyond standard baseline)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for PM-22. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • Privacy program plan
  • policies and procedures addressing personally identifiable information quality management, information life cycle documentation, and sample notices of correction or deletion
  • documentation of reviews and updates of policies and procedures

Testing

  • [Organizational processes for data quality and personally identifiable information quality management procedures
  • mechanisms supporting and/or implementing quality management requirements

Other Records

  • records of monitoring PII quality management practices