Control statement
- a.Remove the following elements of personally identifiable information from datasets: [Organization-defined: elements] ; and
- b.Evaluate [Organization-defined: frequency] for effectiveness of de-identification.
Discussion
De-identification is the general term for the process of removing the association between a set of identifying data and the data subject. Many datasets contain information about individuals that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records. Datasets may also contain other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. Personally identifiable information is removed from datasets by trained individuals when such information is not (or no longer) necessary to satisfy the requirements envisioned for the data. For example, if the dataset is only used to produce aggregate statistics, the identifiers that are not needed for producing those statistics are removed. Removing identifiers improves privacy protection since information that is removed cannot be inadvertently disclosed or improperly used. Organizations may be subject to specific de-identification definitions or methods under applicable laws, regulations, or policies. Re-identification is a residual risk with de-identified data. Re-identification attacks can vary, including combining new datasets or other improvements in data analytics. Maintaining awareness of potential attacks and evaluating for the effectiveness of the de-identification over time support the management of this residual risk.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use De-identification as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to flaw remediation, malicious-code protection, monitoring, integrity, and trustworthy information handling.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- patch and remediation records
- malware protection configuration
- monitoring alerts and response records
- integrity validation and exception reports
Common failure patterns
- patch compliance hides unsupported assets
- alerts generated without response ownership
- exceptions never expire
- integrity monitoring excludes critical configurations
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- SI-19a.[Organization-defined: elements] are removed from datasets;
- SI-19b.the effectiveness of de-identification is evaluated [Organization-defined: frequency].
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- de-identification procedures
- system configuration
- datasets with personally identifiable information removed
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel responsible for identifying unnecessary identifiers
- organizational personnel responsible for removing personally identifiable information from datasets
- organizational personnel with information security and privacy responsibilities
Test
- Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
SI-19(1) — Collection
De-identify the dataset upon collection by not collecting personally identifiable information.
Official discussion
If a data source contains personally identifiable information but the information will not be used, the dataset can be de-identified when it is created by not collecting the data elements that contain the personally identifiable information. For example, if an organization does not intend to use the social security number of an applicant, then application forms do not ask for a social security number.
Assessment objectives and methods
the dataset is de-identified upon collection by not collecting personally identifiable information.
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- de-identification procedures
- procedures for minimizing the collection of personally identifiable information
- system configuration
- data collection mechanisms
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel responsible for de-identifying the dataset
- organizational personnel with information security and privacy responsibilities
Test
- Automated mechanisms preventing the collection of personally identifiable information
SI-19(2) — Archiving
Prohibit archiving of personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.
Official discussion
Datasets can be archived for many reasons. The envisioned purposes for the archived dataset are specified, and if personally identifiable information elements are not required, the elements are not archived. For example, social security numbers may have been collected for record linkage, but the archived dataset may include the required elements from the linked records. In this case, it is not necessary to archive the social security numbers.
Assessment objectives and methods
the archiving of personally identifiable information elements is prohibited if those elements in a dataset will not be needed after the dataset is archived.
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- de-identification procedures
- system configuration documentation
- data archiving mechanisms
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel responsible for de-identifying the dataset
- organizational personnel with dataset archival responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Automated mechanisms prohibiting the archival of personally identifiable information elements
SI-19(3) — Release
Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.
Official discussion
Prior to releasing a dataset, a data custodian considers the intended uses of the dataset and determines if it is necessary to release personally identifiable information. If the personally identifiable information is not necessary, the information can be removed using de-identification techniques.
Assessment objectives and methods
personally identifiable information elements are removed from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- de-identification procedures
- procedures for minimizing the release of personally identifiable information
- system configuration
- data release mechanisms
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel responsible for de-identifying the dataset
- organizational personnel with information security and privacy responsibilities
Test
- Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements from a dataset
SI-19(4) — Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.
Official discussion
There are many possible processes for removing direct identifiers from a dataset. Columns in a dataset that contain a direct identifier can be removed. In masking, the direct identifier is transformed into a repeating character, such as XXXXXX or 999999. Identifiers can be encrypted or hashed so that the linked records remain linked. In the case of encryption or hashing, algorithms are employed that require the use of a key, including the Advanced Encryption Standard or a Hash-based Message Authentication Code. Implementations may use the same key for all identifiers or use a different key for each identifier. Using a different key for each identifier provides a higher degree of security and privacy. Identifiers can alternatively be replaced with a keyword, including transforming "George Washington" to "PATIENT" or replacing it with a surrogate value, such as transforming "George Washington" to "Abraham Polk."
Assessment objectives and methods
direct identifiers in a dataset are removed, masked, encrypted, hashed, or replaced.
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- de-identification procedures
- system configuration
- documentation of de-identified datasets
- tools for the removal, masking, encryption, hashing or replacement of direct identifiers
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel responsible for de-identifying the dataset
- organizational personnel with information security and privacy responsibilities
Test
- Automated mechanisms supporting and/or implementing the removal, masking, encryption, hashing or replacement of direct identifiers
Related controls
SI-19(5) — Statistical Disclosure Control
Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.
Official discussion
Many types of statistical analyses can result in the disclosure of information about individuals even if only summary information is provided. For example, if a school that publishes a monthly table with the number of minority students enrolled, reports that it has 10-19 such students in January, and subsequently reports that it has 20-29 such students in March, then it can be inferred that the student who enrolled in February was a minority.
Assessment objectives and methods
- SI-19(05)[01]numerical data is manipulated so that no individual or organization is identifiable in the results of the analysis;
- SI-19(05)[02]contingency tables are manipulated so that no individual or organization is identifiable in the results of the analysis;
- SI-19(05)[03]statistical findings are manipulated so that no individual or organization is identifiable in the results of the analysis.
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- de-identification procedures
- system configuration
- de-identified datasets
- statistical analysis report
- tools for the control of statistical disclosure
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel responsible for de-identifying the dataset
- organizational personnel with information security and privacy responsibilities
Test
- Automated mechanisms supporting and/or implementing the control of statistical disclosure
SI-19(6) — Differential Privacy
Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.
Official discussion
The mathematical definition for differential privacy holds that the result of a dataset analysis should be approximately the same before and after the addition or removal of a single data record (which is assumed to be the data from a single individual). In its most basic form, differential privacy applies only to online query systems. However, it can also be used to produce machine-learning statistical classifiers and synthetic data. Differential privacy comes at the cost of decreased accuracy of results, forcing organizations to quantify the trade-off between privacy protection and the overall accuracy, usefulness, and utility of the de-identified dataset. Non-deterministic noise can include adding small, random values to the results of mathematical operations in dataset analysis.
Assessment objectives and methods
the disclosure of personally identifiable information is prevented by adding non-deterministic noise to the results of mathematical operations before the results are reported.
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- de-identification procedures
- system configuration
- de-identified datasets
- differential privacy tools
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel responsible for de-identifying the dataset
- organizational personnel with information security and privacy responsibilities
Test
- Online query systems
- automated mechanisms supporting and/or implementing differential privacy
Related controls
SI-19(7) — Validated Algorithms and Software
Perform de-identification using validated algorithms and software that is validated to implement the algorithms.
Official discussion
Algorithms that appear to remove personally identifiable information from a dataset may in fact leave information that is personally identifiable or data that is re-identifiable. Software that is claimed to implement a validated algorithm may contain bugs or implement a different algorithm. Software may de-identify one type of data, such as integers, but not de-identify another type of data, such as floating point numbers. For these reasons, de-identification is performed using algorithms and software that are validated.
Assessment objectives and methods
- SI-19(07)[01]de-identification is performed using validated algorithms;
- SI-19(07)[02]de-identification is performed using software that is validated to implement the algorithms.
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- de-identification procedures
- system configuration
- de-identified datasets
- algorithm and software validation tools
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel responsible for de-identifying the dataset
- organizational personnel with information security and privacy responsibilities
Test
- Validated algorithms and software
SI-19(8) — Motivated Intruder
Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.
Official discussion
A motivated intruder test is a test in which an individual or group takes a data release and specified resources and attempts to re-identify one or more individuals in the de-identified dataset. Such tests specify the amount of inside knowledge, computational resources, financial resources, data, and skills that intruders possess to conduct the tests. A motivated intruder test can determine if the de-identification is insufficient. It can also be a useful diagnostic tool to assess if de-identification is likely to be sufficient. However, the test alone cannot prove that de-identification is sufficient.
Assessment objectives and methods
a motivated intruder test is performed on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.
Examine
- System and information integrity policy
- system and information integrity procedures
- personally identifiable information processing policy
- de-identification procedures
- system configuration
- motivated intruder test procedures
- de-identified datasets
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel responsible for de-identifying the dataset
- organizational personnel with information security and privacy responsibilities
Test
- Motivated intruder test
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.