PT-7(1)_social-security-numbers

PT-7(1) Social Security Numbers

Enhancement of: PT-7

High-Level Description

Family: Personally Identifiable Information Processing and Transparency (PT) Framework: NIST SP 800-53 Rev 5

Federal law and policy establish specific requirements for organizations’ processing of Social Security numbers. Organizations take steps to eliminate unnecessary uses of Social Security numbers and other sensitive information and observe any particular requirements that apply.

What to Check

• Verify PT-7(1) Social Security Numbers is documented in SSP
• Validate all 3 control requirements are implemented
• Confirm control is operating effectively
• Review evidence of continuous monitoring for PT-7(1)
• Verify enhancement builds upon base control PT-7

How to Test

Step 1: Review Documentation

Examine the System Security Plan (SSP) and related artifacts for PT-7(1) implementation details. Verify the organization has documented how this control is satisfied.

Step 2: Validate Implementation

# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly

# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null

Step 3: Test Operating Effectiveness

Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.

Tools

Remediation Guide

Control Statement

When a system processes Social Security numbers: Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier; Do not deny any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his or her Social Security number; and Inform any individual who is asked to disclose his or her Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.

Implementation Guidance

Federal law and policy establish specific requirements for organizations’ processing of Social Security numbers. Organizations take steps to eliminate unnecessary uses of Social Security numbers and other sensitive information and observe any particular requirements that apply.

Risk Assessment

CWE Categories

References

• NIST SP 800-53 Rev 5 - PT-7(1)
• NIST SP 800-53A Rev 5 (Assessment Procedures)
• NIST SP 800-53 Rev 5 Full Catalog

Checklist

• Control documented in SSP
• Implementation evidence collected
• Operating effectiveness validated
• Continuous monitoring in place
• Related controls (IA-4) reviewed