Authorized Use
LOW MODERATE HIGHRequirements NIST SOURCE
Employ the following measures so that data or information collected by [sensors] is only used for authorized purposes: [measures].
Discussion (NIST Supplemental Guidance)
Information collected by sensors for a specific authorized purpose could be misused for some unauthorized purpose. For example, GPS sensors that are used to support traffic navigation could be misused to track the movements of individuals. Measures to mitigate such activities include additional training to help ensure that authorized individuals do not abuse their authority and, in the case where sensor data is maintained by external parties, contractual restrictions on the use of such data.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for SC-42(2) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- measures to be employed so that data or information collected by sensors is only used for authorized purposes are defined;
- <SC-42(02)_ODP measures> are employed so that data or information collected by <SC-42(01)_ODP sensors> is only used for authorized purposes.
Examine
[SELECT FROM: System and communications protection policy; access control policy and procedures; personally identifiable information processing policy; sensor capability and data collection; system design documentation; system configuration settings and associated documentation; system architecture; list of measures to be employed to that the ensure data or information collected by sensors is only used for authorized purposes; system audit records; system security plan; privacy plan; other relevant documents or records].
Interview
[SELECT FROM: System/network administrators; organizational personnel with information security and privacy responsibilities; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for sensor capabilities].
Test
[SELECT FROM: Mechanisms supporting and/or implementing measures to ensure that sensor information is only used for authorized purposes; sensor information collection capability for the system].
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for SC-42(2). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- System and communications protection policy
- access control policy and procedures
- personally identifiable information processing policy
- system security plan
- privacy plan
Configuration
- system design documentation
- system configuration settings and associated documentation
- system architecture
Testing
- Mechanisms supporting and/or implementing measures to ensure that sensor information is only used for authorized purposes
- sensor information collection capability for the system
Other Records
- sensor capability and data collection
- list of measures to be employed to that the ensure data or information collected by sensors is only used for authorized purposes
- system audit records
- other relevant documents or records