← SI-12
SI-12(1) SI · System and Information Integrity

Limit Personally Identifiable Information Elements

LOW MODERATE HIGH
1 Overlay 1 Related Control
Graph
Export ▾

Requirements NIST SOURCE

Limit personally identifiable information being processed in the information life cycle to the following elements of personally identifiable information: [elements of personally identifiable information].

Discussion (NIST Supplemental Guidance)

Limiting the use of personally identifiable information throughout the information life cycle when the information is not needed for operational purposes helps to reduce the level of privacy risk created by a system. The information life cycle includes information creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposition. Risk assessments as well as applicable laws, regulations, and policies can provide useful inputs to determining which elements of personally identifiable information may create risk.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for SI-12(1) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. elements of personally identifiable information being processed in the information life cycle are defined;
  2. personally identifiable information being processed in the information life cycle is limited to <SI-12(01)_ODP elements of personally identifiable information>.

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; personally identifiable information processing procedures; records retention and disposition policy; records retention and disposition procedures; federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to limiting personally identifiable information elements; personally identifiable information inventory; system audit records; audit findings; system security plan; privacy plan; privacy program plan; privacy impact assessment; privacy risk assessment documentation; data mapping documentation; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with information and records management, retention, and disposition responsibilities; organizational personnel with security and privacy responsibilities; network administrators].

Test

[SELECT FROM: Organizational processes for information management and retention (including limiting personally identifiable information processing); automated mechanisms supporting and/or implementing limits to personally identifiable information processing].

Overlays

Showing the OT/ICS overlay for the parent control SI-12 — see the SI-12(1) entries within each baseline below.

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

  • Base control: Included (matches standard baseline)

MODERATE

  • Base control: Included (matches standard baseline)

HIGH

  • Base control: Included (matches standard baseline)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for SI-12(1). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • System and information integrity policy
  • personally identifiable information processing policy
  • records retention and disposition policy
  • federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to limiting personally identifiable information elements
  • system security plan
  • privacy plan
  • privacy program plan

Configuration

  • personally identifiable information inventory

Testing

  • Organizational processes for information management and retention (including limiting personally identifiable information processing)
  • automated mechanisms supporting and/or implementing limits to personally identifiable information processing

Other Records

  • system and information integrity procedures
  • personally identifiable information processing procedures
  • records retention and disposition procedures
  • system audit records
  • audit findings
  • privacy impact assessment
  • privacy risk assessment documentation
  • data mapping documentation
  • other relevant documents or records