← PM-5
PM-5(1) PM · Program Management

Inventory of Personally Identifiable Information

LOW MODERATE HIGH
1 Overlay 10 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Establish, maintain, and update [frequency] an inventory of all systems, applications, and projects that process personally identifiable information.

Discussion (NIST Supplemental Guidance)

An inventory of systems, applications, and projects that process personally identifiable information supports the mapping of data actions, providing individuals with privacy notices, maintaining accurate personally identifiable information, and limiting the processing of personally identifiable information when such information is not needed for operational purposes. Organizations may use this inventory to ensure that systems only process the personally identifiable information for authorized purposes and that this processing is still relevant and necessary for the purpose specified therein.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for PM-5(1) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. the frequency at which to update the inventory of systems, applications, and projects that process personally identifiable information is defined;
  2. an inventory of all systems, applications, and projects that process personally identifiable information is established;
  3. an inventory of all systems, applications, and projects that process personally identifiable information is maintained;
  4. an inventory of all systems, applications, and projects that process personally identifiable information is updated <PM-05(01)_ODP frequency>.

Examine

[SELECT FROM: Procedures addressing system inventory development, maintenance, and updates; OMB FISMA reporting guidance; privacy program plan; information security program plan; personally identifiable information processing policy; system inventory; personally identifiable information inventory; data mapping documentation; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with privacy program planning and plan implementation responsibilities; organizational personnel responsible for developing and maintaining the system inventory; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Organizational processes for system inventory development, maintenance, and updates; mechanisms supporting the system inventory].

Overlays

Showing the OT/ICS overlay for the parent control PM-5 — see the PM-5(1) entries within each baseline below.

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Not applicable at this tier.

MODERATE

Not applicable at this tier.

HIGH

  • Base control: Added (beyond standard baseline)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for PM-5(1). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • privacy program plan
  • information security program plan
  • personally identifiable information processing policy

Configuration

  • Procedures addressing system inventory development, maintenance, and updates
  • system inventory
  • personally identifiable information inventory

Testing

  • Organizational processes for system inventory development, maintenance, and updates
  • mechanisms supporting the system inventory

Other Records

  • OMB FISMA reporting guidance
  • data mapping documentation
  • other relevant documents or records