800-53 · PM Program Management
PM-22
Personally Identifiable Information Quality Management
frameworkNIST SP 800-53 Rev 5.2
sectionPM Program Management
csf 2.0ID.AM-08
topics—
frameworks0 0 0
Official textDevelop and document organization-wide policies and procedures for:
a. Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle;
b. Correcting or deleting inaccurate or outdated personally identifiable information;
c. Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and
d. Appeals of adverse decisions on correction or deletion requests.NIST SP 800-53 Rev 5.2 control statement (public domain)
a. Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle;
b. Correcting or deleting inaccurate or outdated personally identifiable information;
c. Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and
d. Appeals of adverse decisions on correction or deletion requests.NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.AM-08 | Systems, hardware, software, services, and data are managed throughout their life cycles | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| ISO 27001 | A.5.8A.5.9A.5.11A.5.12 | Information security in project management; Inventory of information and other associated assets… | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| CIS v8.1 | CIS 1.1CIS 3.5CIS 1.2CIS 1.3 | Establish and Maintain Detailed Enterprise Asset Inventory; Securely Dispose of Data… | No mapping. Only shares CSF ID.AM-08: related, not a mapping+5 more loosely related (not mappings)CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Only shares CSF ID.AM-08: related, not a mapping …and 1 more in the downloads | |
| SOC 2 | CC6.1 | Logical access security over information assets | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| PCI DSS | 6.2.16.2.26.2.36.2.3.1 | Bespoke and custom software developed securely; Developers trained in secure software development… | No mapping. Only shares CSF ID.AM-08: related, not a mapping+5 more loosely related (not mappings)6.2.4 Coding techniques prevent common software attacks Only shares CSF ID.AM-08: related, not a mapping …and 1 more in the downloads | |
| CMMC | CA.L2-3.12.4MA.L2-3.7.1MA.L2-3.7.3SC.L2-3.13.2 | System Security Plan; Perform Maintenance… | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| HIPAA | §164.308(a)(1)(ii)(B)§164.308(b)(4)§164.310(a)(2)(ii)§164.310(a)(2)(iv) | Risk Management; Written Contract or Other Arrangement… | No mapping. Only shares CSF ID.AM-08: related, not a mapping+10 more loosely related (not mappings)§164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF ID.AM-08: related, not a mapping …and 6 more in the downloads | |
| GDPR | Art.30(1) | Records of processing activities | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| NIS2 | 6.212.4 | Secure development life cycle; Asset inventory | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| DORA | Art.8(1)Art.8(4)Art.8(6) | Identification; Identification… | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| CPS 234 | Para 20 | Classify information assets by criticality and sensitivity | No mapping. Only shares CSF ID.AM-08: related, not a mapping | |
| Cyber Essentials | CE 3 | Security Update Management | No mapping. Only shares CSF ID.AM-08: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.