NIST Draft SP 800-53 Appendix J DRAFT Privacy Control Catalog

　こんにちは、丸山満彦です。NISTがSP 800-53 Appendix J DRAFT Privacy Control Catalogを公開していますね。。。

＝＝＝＝＝
・Provide a structured set of privacy controls, based on international standards and best practices, that help organizations enforce requirements deriving from federal privacy legislation, policies, regulations, directives, standards, and guidance;
・Establish a linkage and relationship between privacy and security controls for purposes of enforcing respective privacy and security requirements which may overlap in concept and in implementation within federal information systems, programs, and organizations;
・Demonstrate the applicability of the NIST Risk Management Framework in the selection, implementation, assessment, and monitoring of privacy controls deployed in federal information systems, programs, and organizations; and
・Promote closer cooperation between privacy and security officials within the federal government to help achieve the objectives of senior leaders/executives in enforcing the requirements in federal privacy legislation, policies, regulations, directives, standards, and guidance.
＝＝＝＝＝

　
■NIST
・2011.07.19 SP 800-53 Appendix J DRAFT Privacy Control Catalog

●Draft_800-53-privacy-appendix-J.pdf
＝＝＝＝＝
TR Transparency
　TR-1 Privacy Notice
　TR-2 Dissemination of Privacy Program Information
IP Individual Participation and Redress
　IP-1 Consent
　IP-2 Access
　IP-3 Redress
　IP-4 Complaint Management
AP Authority and Purpose
　AP-1 Authority to Collect
　AP-2 Purpose Specification
DM Data Minimization and Retention
　DM-1 Minimization of Personally Identifiable Information
　DM-2 Data Retention and Disposal
UL Use Limitation
　UL-1 Internal Use
　UL-2 Information Sharing
　UL-3 System Design and Development
DI Data Quality and Integrity
　DI-1 Data Quality
　DI-2 Data Integrity
SE Security
　SE-1 Inventory of Personally Identifiable Information
　SE-2 Privacy Incident Response
AR Accountability, Audit, and Risk Management
　AR-1 Governance and Privacy Program
　AR-2 Privacy Impact and Risk Assessment
　AR-3 Privacy Requirements for Contractors and Service Providers
　AR-4 Privacy Monitoring and Auditing
　AR-5 Privacy Awareness and Training
　AR-6 Privacy Reporting
＝＝＝＝＝