Showing 100 controls
CM.AW-P1
Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preference...
CM.AW-P2
Mechanisms for obtaining feedback from individuals (e.g., surveys or focus groups) about data processing and associated privacy risks are established and in place.
CM.AW-P3
System/product/service design enables data processing visibility.
CM.AW-P4
Records of data disclosures and sharing are maintained and can be accessed for review or transmission/disclosure.
CM.AW-P5
Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
CM.AW-P6
Data provenance and lineage are maintained and can be accessed for review or transmission/disclosure.
CM.AW-P7
Impacted individuals and organizations are notified about a privacy breach or event.
CM.AW-P8
Individuals are provided with mitigation mechanisms (e.g., credit monitoring, consent withdrawal, data alteration or deletion) to address impacts of problematic data actions.
CM.PO-P1
Transparency policies, processes, and procedures for communicating data processing purposes, practices, and associated privacy risks are established and in place.
CM.PO-P2
Roles and responsibilities (e.g., public relations) for communicating data processing purposes, practices, and associated privacy risks are established.
CT.DM-P1
Data elements can be accessed for review.
CT.DM-P10
Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
CT.DM-P2
Data elements can be accessed for transmission or disclosure.
CT.DM-P3
Data elements can be accessed for alteration.
CT.DM-P4
Data elements can be accessed for deletion.
CT.DM-P5
Data are destroyed according to policy.
CT.DM-P6
Data are transmitted using standardized formats.
CT.DM-P7
Mechanisms for transmitting processing permissions and related data values with data elements are established and in place.
CT.DM-P8
Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
CT.DM-P9
Technical measures implemented to manage data processing are tested and assessed.
CT.DP-P1
Data are processed to limit observability and linkability (e.g., data actions take place on local devices, privacy-preserving cryptography).
CT.DP-P2
Data are processed to limit the identification of individuals (e.g., de-identification privacy techniques, tokenization).
CT.DP-P3
Data are processed to limit the formulation of inferences about individuals’ behavior or activities (e.g., data processing is decentralized, distributed architectures).
CT.DP-P4
System or device configurations permit selective collection or disclosure of data elements.
CT.DP-P5
Attribute references are substituted for attribute values.
CT.PO-P1
Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in...
CT.PO-P2
Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retent...
CT.PO-P3
Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
CT.PO-P4
A data life cycle to manage data is aligned and implemented with the system development life cycle to manage systems.
GV.AT-P1
The workforce is informed and trained on its roles and responsibilities.
GV.AT-P2
Senior executives understand their roles and responsibilities.
GV.AT-P3
Privacy personnel understand their roles and responsibilities.
GV.AT-P4
Third parties (e.g., service providers, customers, partners) understand their roles and responsibilities.
GV.MT-P1
Privacy risk is re-evaluated on an ongoing basis and as key factors, including the organization’s business environment (e.g., introduction of new technologies), governance (e.g., legal obligations, ri...
GV.MT-P2
Privacy values, policies, and training are reviewed and any updates are communicated.
GV.MT-P3
Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.
GV.MT-P4
Policies, processes, and procedures for communicating progress on managing privacy risks are established and in place.
GV.MT-P5
Policies, processes, and procedures are established and in place to receive, analyze, and respond to problematic data actions disclosed to the organization from internal and external sources (e.g., in...
GV.MT-P6
Policies, processes, and procedures incorporate lessons learned from problematic data actions.
GV.MT-P7
Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
GV.PO-P1
Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and c...
GV.PO-P2
Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
GV.PO-P3
Roles and responsibilities for the workforce are established with respect to privacy.
GV.PO-P4
Privacy roles and responsibilities are coordinated and aligned with third-party stakeholders (e.g., service providers, customers, partners).
GV.PO-P5
Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
GV.PO-P6
Governance and risk management policies, processes, and procedures address privacy risks.
GV.RM-P1
Risk management processes are established, managed, and agreed to by organizational stakeholders.
GV.RM-P2
Organizational risk tolerance is determined and clearly expressed.
GV.RM-P3
The organization’s determination of risk tolerance is informed by its role(s) in the data processing ecosystem.
ID.BE-P1
The organization’s role(s) in the data processing ecosystem are identified and communicated.
ID.BE-P2
Priorities for organizational mission, objectives, and activities are established and communicated.
ID.BE-P3
Systems/products/services that support organizational priorities are identified and key requirements communicated.
ID.DE-P1
Data processing ecosystem risk management policies, processes, and procedures are identified, established, assessed, managed, and agreed to by organizational stakeholders.
ID.DE-P2
Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessmen...
ID.DE-P3
Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
ID.DE-P4
Interoperability frameworks or similar multi-party approaches are used to manage data processing ecosystem privacy risks.
ID.DE-P5
Data processing ecosystem parties are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual, interoperability framework, or other o...
ID.IM-P1
Systems/products/services that process data are inventoried.
ID.IM-P2
Owners or operators (e.g., the organization or third parties such as service providers, partners, customers, and developers) and their roles with respect to the systems/products/services and component...
ID.IM-P3
Categories of individuals (e.g., customers, employees or prospective employees, consumers) whose data are being processed are inventoried.
ID.IM-P4
Data actions of the systems/products/services are inventoried.
ID.IM-P5
The purposes for the data actions are inventoried.
ID.IM-P6
Data elements within the data actions are inventoried.
ID.IM-P7
The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).
ID.IM-P8
Data processing is mapped, illustrating the data actions and associated data elements for systems/products/services, including components; roles of the component owners/operators; and interactions of...
ID.RA-P1
Contextual factors related to the systems/products/services and the data actions are identified (e.g., individuals’ demographics and privacy interests or perceptions, data sensitivity and/or types, vi...
ID.RA-P2
Data analytic inputs and outputs are identified and evaluated for bias.
ID.RA-P3
Potential problematic data actions and associated problems are identified.
ID.RA-P4
Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
ID.RA-P5
Risk responses are identified, prioritized, and implemented.
PR.AC-P1
Identities and credentials are issued, managed, verified, revoked, and audited for authorized individuals, processes, and devices.
PR.AC-P2
Physical access to data and devices is managed.
PR.AC-P3
Remote access is managed.
PR.AC-P4
Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
PR.AC-P5
Network integrity is protected (e.g., network segregation, network segmentation).
PR.AC-P6
Individuals and devices are proofed and bound to credentials, and authenticated commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational ri...
PR.DS-P1
Data-at-rest are protected.
PR.DS-P2
Data-in-transit are protected.
PR.DS-P3
Systems/products/services and associated data are formally managed throughout removal, transfers, and disposition.
PR.DS-P4
Adequate capacity to ensure availability is maintained.
PR.DS-P5
Protections against data leaks are implemented.
PR.DS-P6
Integrity checking mechanisms are used to verify software, firmware, and information integrity.
PR.DS-P7
The development and testing environment(s) are separate from the production environment.
PR.DS-P8
Integrity checking mechanisms are used to verify hardware integrity.
PR.MA-P1
Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools.
PR.MA-P2
Remote maintenance of organizational assets is approved, logged, and performed in a manner that prevents unauthorized access.
PR.PO-P1
A baseline configuration of information technology is created and maintained incorporating security principles (e.g., concept of least functionality).
PR.PO-P10
A vulnerability management plan is developed and implemented.
PR.PO-P2
Configuration change control processes are established and in place.
PR.PO-P3
Backups of information are conducted, maintained, and tested.
PR.PO-P4
Policy and regulations regarding the physical operating environment for organizational assets are met.
PR.PO-P5
Protection processes are improved.
PR.PO-P6
Effectiveness of protection technologies is shared.
PR.PO-P7
Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
PR.PO-P8
Response and recovery plans are tested.
PR.PO-P9
Privacy procedures are included in human resources practices (e.g., deprovisioning, personnel screening).
PR.PT-P1
Removable media is protected and its use restricted according to policy.
PR.PT-P2
The principle of least functionality is incorporated by configuring systems to provide only essential capabilities.
PR.PT-P3
Communications and control networks are protected.
PR.PT-P4
Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.