What this control covers
Determine and document information to provide to PII principals and timing. Implementation: Define notice content and timing; document delivery channels. Justification: Needed for notice and transparency requirements.
Why it matters
Encryption and key management make data unreadable to attackers and unintelligible under data-breach safe-harbour clauses — a meaningful regulatory benefit.
How to implement
AWS
Default to SSE-KMS with customer-managed keys for S3/EBS/RDS/Secrets Manager. Use S3 Bucket Keys and S3 Block Public Access at the account level, and turn on S3 Object Lock on backup buckets for ransomware resilience.
Azure
Store secrets in Key Vault (HSM-backed where required) with soft-delete + purge protection; use customer-managed keys for Storage, SQL, and Azure Disk Encryption. Tag PII data via Microsoft Purview.
GCP
Use Cloud KMS with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. Sensitive Data Protection (DLP API) inspects/de-identifies PII at scale.
Google Workspace
Enable client-side encryption for Drive/Docs and turn on Drive Labels + DLP rules to prevent external sharing of regulated data classes.
On-premises
Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.
Evidence to collect
ticketing_workflow— See the iCompaas Evidence library for the canonical source for this evidence type.policy_document— A signed, version-controlled policy stating leadership intent and the named owner.
Signed policies, procedures, and registers document the safeguard. Service management or request-handling tickets prove timely handling. Focus: Information for PII principals.
Quick checklist
- Implement — Information For Pii Principals
- Define — Information For Pii Principals
- Document — Information For Pii Principals
Related articles on this site
- Security Headers Remediation - Content Security Policy
- NIST 800-171 3.1.9 Provide privacy and security notices consistent with applicable CUI rules.
- NIST 800-171 3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
- CMMC 2.0 AC.2.005 Provide privacy and security notices consistent with applicable CUI rules.