PT-3 PT · Personally Identifiable Information Processing and Transparency

Personally Identifiable Information Processing Purposes

LOW MODERATE HIGH
2 Enhancements 0 Overlays 15 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Discussion (NIST Supplemental Guidance)

Identifying and documenting the purpose for processing provides organizations with a basis for understanding why personally identifiable information may be processed. The term "process" includes every step of the information life cycle, including creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal. Identifying and documenting the purpose of processing is a prerequisite to enabling owners and operators of the system and individuals whose information is processed by the system to understand how the information will be processed. This enables individuals to make informed decisions about their engagement with information systems and organizations and to manage their privacy interests. Once the specific processing purpose has been identified, the purpose is described in the organization’s privacy notices, policies, and any related privacy compliance documentation, including privacy impact assessments, system of records notices, PRIVACT statements, computer matching notices, and other applicable Federal Register notices. Organizations take steps to help ensure that personally identifiable information is processed only for identified purposes, including training organizational personnel and monitoring and auditing organizational processing of personally identifiable information. Organizations monitor for changes in personally identifiable information processing. Organizational personnel consult with the senior agency official for privacy and legal counsel to ensure that any new purposes that arise from changes in processing are compatible with the purpose for which the information was collected, or if the new purpose is not compatible, implement mechanisms in accordance with defined requirements to allow for the new processing, if appropriate. Mechanisms may include obtaining consent from individuals, revising privacy policies, or other measures to manage privacy risks that arise from changes in personally identifiable information processing purposes.

Enhancements NIST SOURCE

PT-3(1) Data Tagging LOW MODERATE HIGH

Attach data tags containing the following purposes to [elements of personally identifiable information]: [processing purposes].

Discussion

Data tags support the tracking of processing purposes by conveying the purposes along with the relevant elements of personally identifiable information throughout the system. By conveying the processing purposes in a data tag along with the personally identifiable information as the information transits a system, a system owner or operator can identify whether a change in processing would be compatible with the identified and documented purposes. Data tags may also support the use of automated tools.

Open full page for PT-3(1) →
PT-3(2) Automation LOW MODERATE HIGH

Track processing purposes of personally identifiable information using [automated mechanisms].

Discussion

Automated mechanisms augment tracking of the processing purposes.

Open full page for PT-3(2) →

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for PT-3 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. the purpose(s) for processing personally identifiable information is/are defined;
  2. the processing of personally identifiable information to be restricted is defined;
  3. mechanisms to be implemented for ensuring any changes in the processing of personally identifiable information are made in accordance with requirements are defined;
  4. requirements for changing the processing of personally identifiable information are defined;
  5. the <PT-03_ODP[01] purpose(s)> for processing personally identifiable information is/are identified and documented;
  6. the purpose(s) is/are described in the public privacy notices of the organization;
  7. the purpose(s) is/are described in the policies of the organization;
  8. the <PT-03_ODP[02] processing> of personally identifiable information are restricted to only that which is compatible with the identified purpose(s);
  9. changes in the processing of personally identifiable information are monitored;
  10. <PT-03_ODP[03] mechanisms> are implemented to ensure that any changes are made in accordance with <PT-03_ODP[04] requirements>.

Examine

[SELECT FROM: Personally identifiable information processing and transparency policy and procedures; configuration management plan; organizational privacy notices; organizational policies; Privacy Act statements; computer matching notices; applicable Federal Register notices; documented requirements for enforcing and monitoring the processing of personally identifiable information; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Organizational processes for authorizing the processing of personally identifiable information; mechanisms supporting and/or implementing the management of authorized personally identifiable information processing; organizational processes for monitoring changes in processing personally identifiable information].

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for PT-3. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • Personally identifiable information processing and transparency policy and procedures
  • organizational policies
  • privacy plan

Configuration

  • configuration management plan

Testing

  • Organizational processes for authorizing the processing of personally identifiable information
  • mechanisms supporting and/or implementing the management of authorized personally identifiable information processing
  • organizational processes for monitoring changes in processing personally identifiable information

Other Records

  • organizational privacy notices
  • Privacy Act statements
  • computer matching notices
  • applicable Federal Register notices
  • documented requirements for enforcing and monitoring the processing of personally identifiable information
  • other relevant documents or records