Nist 800 122

- Review current holding of PII and ensure they are accurate, relevant, timely, and complete. - Reduce PII holdings to the minimum necessary for proper performance of agency functions. - Develop a schedule for periodic review of PII holdings. - Establish a plan to eliminate the unnecessary collection and use of SSN's

Organizations should evaluate how easily PII can be used to identify specific individuals.

Organizations should consider how many individuals can be identified from the PII. Breaches of 25 records and 25 million records may have different impacts.

Organizations should evaluate the sensitivity of each individual PII data field.

Organizations should evaluate the context of use - the purpose for which the PII is collected, stored, used, processed, disclosed, or disseminated.

An organization that is subject to any obligations to protect PII should consider such obligations when determining the PII confidentiality impact level.

Organizations may choose to take into consideration the nature of authorized access to and the location of PII.

Not all PII should be protected in the same way.

Organizations should develop comprehensive policies and procedures for protecting the confidentiality of PII.

Organizations should reduce the possibility that PII will be accessed, used, or disclosed inappropriately by requiring that all individuals receive appropriate training before being granted access to systems containing PII.

Organizations can de-identify records by removing enough PII such that the remaining information does not identify an individual and there is no reasonable basis to believe that the information can be used to identify and individual.

Organizations can control access to PII through access control policies and access enforcement mechanisms.

Organizations can prohibit or strictly limit access to PII from portable and mobile devices, such as laptops, cell phones, and personal digital assistants (PDA), which are generally higher-risk than non-portable devices (e.g., desktop computers at the organization's facilities).

Organizations can protect the confidentiality of transmitted PII. This is most often accomplished by encrypting the communications or by encrypting the information before it is transmitted.

Organizations can monitor events that affect the confidentiality of PII, such as inappropriate access to PII.

Breaches involving PII are hazardous to both individuals and organizations.