PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: PM-23, PT-3, SA-3, SA-8, SI-12

Control statement

• a. Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research;
• b. Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes;
• c. Authorize the use of personally identifiable information when such information is required for internal testing, training, and research; and
• d. Review and update policies and procedures [Assignment: organization-defined frequency].

NIST discussion

The use of personally identifiable information in testing, research, and training increases the risk of unauthorized disclosure or misuse of such information. Organizations consult with the senior agency official for privacy and/or legal counsel to ensure that the use of personally identifiable information in testing, training, and research is compatible with the original purpose for which it was collected. When possible, organizations use placeholder data to avoid exposure of personally identifiable information when conducting testing, training, and research.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-25

Determine if:

• PM-25a.
  • PM-25a.[01] policies that address the use of personally identifiable information for internal testing are developed and documented;
  • PM-25a.[02] policies that address the use of personally identifiable information for internal training are developed and documented;
  • PM-25a.[03] policies that address the use of personally identifiable information for internal research are developed and documented;
  • PM-25a.[04] procedures that address the use of personally identifiable information for internal testing are developed and documented;
  • PM-25a.[05] procedures that address the use of personally identifiable information for internal training are developed and documented;
  • PM-25a.[06] procedures that address the use of personally identifiable information for internal research are developed and documented;
  • PM-25a.[07] policies that address the use of personally identifiable information for internal testing, are implemented;
  • PM-25a.[08] policies that address the use of personally identifiable information for training are implemented;
  • PM-25a.[09] policies that address the use of personally identifiable information for research are implemented;
  • PM-25a.[10] procedures that address the use of personally identifiable information for internal testing are implemented;
  • PM-25a.[11] procedures that address the use of personally identifiable information for training are implemented;
  • PM-25a.[12] procedures that address the use of personally identifiable information for research are implemented;
• PM-25b.
  • PM-25b.[01] the amount of personally identifiable information used for internal testing purposes is limited or minimized;
  • PM-25b.[02] the amount of personally identifiable information used for internal training purposes is limited or minimized;
  • PM-25b.[03] the amount of personally identifiable information used for internal research purposes is limited or minimized;
• PM-25c.
  • PM-25c.[01] the required use of personally identifiable information for internal testing is authorized;
  • PM-25c.[02] the required use of personally identifiable information for internal training is authorized;
  • PM-25c.[03] the required use of personally identifiable information for internal research is authorized;
• PM-25d.
  • PM-25d.[01] policies are reviewed [Assignment: organization-defined frequency];
  • PM-25d.[02] policies are updated [Assignment: organization-defined frequency];
  • PM-25d.[03] procedures are reviewed [Assignment: organization-defined frequency];
  • PM-25d.[04] procedures are updated [Assignment: organization-defined frequency].

Examine: Privacy program plan; policies and procedures for the minimization of personally identifiable information used in testing, training, and research; documentation supporting policy implementation (e.g., templates for testing, training, and research; privacy threshold analysis; privacy risk assessment); data sets used for testing, training, and research.

Interview: Organizational personnel with privacy program responsibilities; organizational personnel with privacy responsibilities; system developers; personnel with IRB responsibilities.

Test: Organizational processes for data quality and personally identifiable information management; mechanisms supporting data quality management and personally identifiable information management to minimize the use of personally identifiable information.

Policy statement

• The Senior privacy official shall develop, document and implement policies and procedures for using personally identifiable information in internal testing, training and research. (PM-25a)
• Internal testing, training and research shall use no more personally identifiable information than the purpose needs, and shall use synthetic or de-identified data wherever it serves the purpose. (PM-25b)
• The Senior privacy official shall authorize each use of personally identifiable information for internal testing, training or research before it begins. (PM-25c)
• The Senior privacy official shall review those policies Fill in: the frequency for reviewing policies that address the use of personally identifiable information for internal testing, training, and research Typical: annually and update them Fill in: the frequency for updating policies that address the use of personally identifiable information for internal testing, training, and research Typical: annually, and whenever the review finds a change is needed. (PM-25d)
• The Senior privacy official shall review those procedures Fill in: the frequency for reviewing procedures that address the use of personally identifiable information for internal testing, training, and research Typical: annually and update them Fill in: the frequency for updating procedures that address the use of personally identifiable information for internal testing, training, and research Typical: annually, and whenever the review finds a change is needed. (PM-25d)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-25 asks for policies and procedures for using personally identifiable information in internal testing, training and research (a). You limit or minimize the amount used (b), authorize each use the work requires (c), and review and update the policies and procedures at a set frequency (d). PM-25 is in the SP 800-53B Privacy baseline.

NIST’s PM-25 discussion says using personally identifiable information in testing, research and training raises the risk of unauthorized disclosure or misuse. The organization consults the senior agency official for privacy or legal counsel to make sure the use is compatible with the purpose for which the information was collected (PT-3). Where possible, it uses placeholder data instead. SA-3(2) addresses the same risk for live data in development and test environments, and SI-19 covers de-identification.

Common implementations. The Program Management policy has the senior privacy official write the policies and procedures, authorize each use before it begins, and review them. Its clause also sets the default: use synthetic or de-identified data wherever it serves the purpose. A procedure that would pass an assessment:

• Starts from synthetic, masked or de-identified data, and asks for real data only when the purpose cannot be met without it. NIST SP 800-188 (September 2023, current as of October 2026) describes de-identification techniques and their limits.
• Uses a request that states the purpose, the data elements, the number of records, the environment, who will have access and when the data will be disposed of.
• Records the senior privacy official’s approval, with any conditions, before anyone copies the data.
• Protects the data in the test, training or research environment as it is protected in production.
• Disposes of the data when the authorized use ends, and records it (SI-12).
• Keeps a register of authorized uses, which the review under PM-25d checks.

Record each approved use in the system’s privacy impact assessment. Its section 4 asks about uses beyond the stated purposes, including testing with real data. SP 800-53A also names personnel with institutional review board responsibilities, so an organization that does research involving people includes its review board in the procedure.

Organization-defined parameters. From templates/policy/pm/. Typical values, which your organization may set differently:

Parameter	Typical value
Policy review frequency (d)	Annually
Policy update frequency (d)	Annually, and whenever the review finds a change is needed
Procedure review frequency (d)	Annually
Procedure update frequency (d)	Annually, and whenever the review finds a change is needed

Evidence assessors ask for.

• The policies and procedures for testing, training and research, with their review and update dates (a, d)
• The register of authorized uses, each with the senior privacy official’s approval dated before the use began (c)
• Samples of test, training and research data sets, showing synthetic, masked or de-identified data, or only the real data the approval allowed (b)
• Records of disposal when each authorized use ended
• Privacy impact assessments that list the approved uses

Inheritance. PM-25 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system’s developers, testers and trainers follow the procedure and request approval through it.

Common findings.

• Production databases copied into development or test environments with no approval and no masking.
• Training material and demonstrations that use real customer or employee records.
• One approval for a project reused for new data sets or new purposes.
• Test environments with weaker access controls than production that hold the same data.
• Real data kept after the test, course or study ended.

Enhancements. PM-25 has no enhancements.

Federal systems (as of October 2026). OMB Circular A-130, Appendix II, section 3, lists the Fair Information Practice Principles, which OMB says agencies should apply and which are “not OMB requirements”. Its minimization principle (3.d) says agencies should only use personally identifiable information “that is directly relevant and necessary to accomplish a legally authorized purpose.” For records in a system of records, the Privacy Act allows disclosure inside the agency without consent to officers and employees “who have a need for the record in the performance of their duties” (5 U.S.C. § 552a(b)(1)). Recording that need with each authorization under PM-25c helps show the disclosure was permitted.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy