Privacy - Minimization of Personally Identifiable Information - Regular Reviews of PII Holdings For Continued Need, v1.0

Defines conformance and assessment criteria for verifying that an organization establishes and follows a schedule for regularly reviewing PII holdings at least annually to ensure that the PII continues to be necessary to accomplish the legally authorized purpose.
If an assessment step references organization-defined elements (E.g. <organization-defined personnel or roles>, <organization-defined frequency>, etc.), corresponding citations/excerpts must be provided to confirm that the organization has established and documented these values and that they apply as referenced in the conformance criteria.

Similarly, if a "Selection" among multiple options (e.g. [Selection (one or more): as needed; ]) is specified, evidence must be provided to establish that the option(s) implemented by the organization have been defined and documented.

The assessment step shall not be marked as satisfied without this evidence.

Assessment Step

1
Privacy - Minimization of Personally Identifiable Information - Regular Reviews of PII Holdings For Continued Need (Privacy-MinimizationofPersonallyIdentifiableInformation-RegularReviewsofPIIHoldingsForContinuedNeed)
Does the organization establish and follow a schedule for regularly reviewing PII holdings [Assignment: organization-defined frequency, at least annually] to ensure that the PII continues to be necessary to accomplish the legally authorized purpose?
Artifact
A1
Provide evidence (e.g. organizational policies, procedures, compliance/assessment reports, etc.) that support the assessor's response to this assessment step.
Parameter
Review Frequencyrequired
NUMBER : Provide the frequency (in months) at which the organization reviews its PII holdings.
If conformance criteria reference organization-defined elements (e.g. <organization-defined personnel or roles>, <organization-defined frequency>, etc.), these values must be defined and documented by the organization.

Similarly, if the criteria specify a "Selection" among multiple options (e.g. [Selection (one or more): as needed; ]), the option(s) implemented by the organization must also be defined and documented.

Conformance Criteria (1)

C1
The organization establishes and follows a schedule for regularly reviewing PII holdings [Assignment: organization-defined frequency, at least annually] to ensure that the PII continues to be necessary to accomplish the legally authorized purpose.
Citation
SP800-53R4
Appendix J, DM-1 [c]