SC-7(24) Personally Identifiable Information
Control enhancement of SC-7 Boundary Protection
Control
For systems that process personally identifiable information:
Apply the following processing rules to data elements of personally identifiable information: [Assignment: processing rules];
Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system;
Document each processing exception; and
Review and remove exceptions that are no longer supported.
Discussion
Managing the processing of personally identifiable information is an important aspect of protecting an individual’s privacy. Applying, monitoring for, and documenting exceptions to processing rules ensure that personally identifiable information is processed only in accordance with established privacy requirements.
Related controls
Need SC-7(24) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.