NIST 800-53 REV 5 • SYSTEM AND INFORMATION INTEGRITY
SI-18 — Personally Identifiable Information Quality Operations
Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle {{ insert: param, si-18_prm_1 }} ; and Correct or delete inaccurate or outdated personally identifiable information.
Supplemental Guidance
Personally identifiable information quality operations include the steps that organizations take to confirm the accuracy and relevance of personally identifiable information throughout the information life cycle. The information life cycle includes the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of personally identifiable information. Personally identifiable information quality operations include editing and validating addresses as they are collected or entered into systems using automated address verification look-up application programming interfaces. Checking personally identifiable information quality includes the tracking of updates or changes to data over time, which enables organizations to know how and what personally identifiable information was changed should erroneous information be identified. The measures taken to protect personally identifiable information quality are based on the nature and context of the personally identifiable information, how it is to be used, how it was obtained, and the potential de-identification methods employed. The measures taken to validate the accuracy of personally identifiable information used to make determinations about the rights, benefits, or privileges of individuals covered under federal programs may be more comprehensive than the measures used to validate personally identifiable information used for less sensitive purposes.
Practitioner Notes
Maintain the quality and accuracy of personally identifiable information throughout its lifecycle. Inaccurate PII can lead to wrong decisions and harm to individuals.
Example 1: Implement data quality checks in your HR and customer databases. Run periodic reports to identify duplicate records, inconsistent addresses, invalid phone numbers, and outdated email addresses. Assign data stewards to review and correct discrepancies.
Example 2: Provide a self-service portal where employees and customers can review and update their own PII (address, phone, email). Changes go through a verification process before being applied to ensure accuracy.