Control statement
Apply [Organization-defined: processing conditions] for specific categories of personally identifiable information.
Discussion
Organizations apply any conditions or protections that may be necessary for specific categories of personally identifiable information. These conditions may be required by laws, executive orders, directives, regulations, policies, standards, or guidelines. The requirements may also come from the results of privacy risk assessments that factor in contextual changes that may result in an organizational determination that a particular category of personally identifiable information is particularly sensitive or raises particular privacy risks. Organizations consult with the senior agency official for privacy and legal counsel regarding any protections that may be necessary.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Specific Categories of Personally Identifiable Information as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to privacy authority, purpose, transparency, consent, individual rights, and data-processing governance.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- privacy notices and consent records
- authority and purpose documentation
- data-processing inventories
- individual request and redress records
Common failure patterns
- collection justified by convenience rather than authority
- notices do not reflect actual processing
- secondary use expands without review
- retention and deletion commitments not enforced
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
[Organization-defined: processing conditions] are applied for specific categories of personally identifiable information.
Examine
- Personally identifiable information processing and transparency policy and procedures
- privacy notice
- Privacy Act system of records
- computer matching agreements and notices
- contracts
- privacy information sharing agreements
- memoranda of understanding
- governing requirements
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for supporting and/or implementing personally identifiable information processing
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
PT-7(1) — Social Security Numbers
When a system processes Social Security numbers:
- (a)Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier;
- (b)Do not deny any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his or her Social Security number; and
- (c)Inform any individual who is asked to disclose his or her Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.
Official discussion
Federal law and policy establish specific requirements for organizations’ processing of Social Security numbers. Organizations take steps to eliminate unnecessary uses of Social Security numbers and other sensitive information and observe any particular requirements that apply.
Assessment objectives and methods
- PT-07(01)(a)
- PT-07(01)(a)[01]when a system processes Social Security numbers, the unnecessary collection, maintenance, and use of Social Security numbers are eliminated;
- PT-07(01)(a)[02]when a system processes Social Security numbers, alternatives to the use of Social Security Numbers as a personal identifier are explored;
- PT-07(01)(b)when a system processes Social Security numbers, individual rights, benefits, or privileges provided by law are not denied because of an individual’s refusal to disclose their Social Security number;
- PT-07(01)(c)
- PT-07(01)(c)[01]when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it;
- PT-07(01)(c)[02]when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed by what statutory or other authority the number is solicited;
- PT-07(01)(c)[03]when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed what uses will be made of it.
Examine
- Personally identifiable information processing and transparency policy and procedures
- privacy notice
- Privacy Act system of records
- privacy notice
- separate notice regarding the use of Social Security numbers
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for identifying, reviewing, and taking action to control the unnecessary use of Social Security numbers
- implementation of an alternative to Social Security numbers as identifiers
Related controls
PT-7(2) — First Amendment Information
Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.
Official discussion
The [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) limits agencies’ ability to process information that describes how individuals exercise rights guaranteed by the First Amendment. Organizations consult with the senior agency official for privacy and legal counsel regarding these requirements.
Assessment objectives and methods
the processing of information describing how any individual exercises rights guaranteed by the First Amendment is prohibited unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.
Examine
- Personally identifiable information processing and transparency policy and procedures
- privacy notice
- Privacy Act system of records
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for supporting and/or implementing personally identifiable information processing
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.