ComplianceNIST 800-53 enhancement

NIST-PM-5(1) Inventory of Personally Identifiable Information

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
PM Program Management
Control
PM-5(1)

Control statement

Establish, maintain, and update [Assignment: frequency] an inventory of all systems, applications, and projects that process personally identifiable information.

Discussion

An inventory of systems, applications, and projects that process personally identifiable information supports the mapping of data actions, providing individuals with privacy notices, maintaining accurate personally identifiable information, and limiting the processing of personally identifiable information when such information is not needed for operational purposes. Organizations may use this inventory to ensure that systems only process the personally identifiable information for authorized purposes and that this processing is still relevant and necessary for the purpose specified therein.

Related

Enhancement of · Compliance (1)

  • NIST-PM-5 System Inventory NIST 800-53 control

Related control · Compliance (10)

  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-CM-12 Information Location NIST 800-53 control
  • NIST-CM-13 Data Action Mapping NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-PL-8 Security and Privacy Architectures NIST 800-53 control
  • NIST-PM-22 Personally Identifiable Information Quality Management NIST 800-53 control
  • NIST-PT-3 Personally Identifiable Information Processing Purposes NIST 800-53 control
  • NIST-PT-5 Privacy Notice NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control
  • NIST-SI-18 Personally Identifiable Information Quality Operations NIST 800-53 control