SI-18 Personally Identifiable Information Quality Operations

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	5 (1 in a baseline)

Related controls: PM-22, PM-24, PT-2, SI-4

Control statement

• a. Check the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle [Assignment: organization-defined frequency] ; and
• b. Correct or delete inaccurate or outdated personally identifiable information.

NIST discussion

Personally identifiable information quality operations include the steps that organizations take to confirm the accuracy and relevance of personally identifiable information throughout the information life cycle. The information life cycle includes the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of personally identifiable information. Personally identifiable information quality operations include editing and validating addresses as they are collected or entered into systems using automated address verification look-up application programming interfaces. Checking personally identifiable information quality includes the tracking of updates or changes to data over time, which enables organizations to know how and what personally identifiable information was changed should erroneous information be identified. The measures taken to protect personally identifiable information quality are based on the nature and context of the personally identifiable information, how it is to be used, how it was obtained, and the potential de-identification methods employed. The measures taken to validate the accuracy of personally identifiable information used to make determinations about the rights, benefits, or privileges of individuals covered under federal programs may be more comprehensive than the measures used to validate personally identifiable information used for less sensitive purposes.

Control enhancements

SI-18(1) Automation Support

Baselines: Not in a baseline

Correct or delete personally identifiable information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using [Assignment: organization-defined automated mechanisms].

Discussion and assessment objectives for SI-18(1)

The use of automated mechanisms to improve data quality may inadvertently create privacy risks. Automated tools may connect to external or otherwise unrelated systems, and the matching of records between these systems may create linkages with unintended consequences. Organizations assess and document these risks in their privacy impact assessments and make determinations that are in alignment with their privacy program plans.

As data is obtained and used across the information life cycle, it is important to confirm the accuracy and relevance of personally identifiable information. Automated mechanisms can augment existing data quality processes and procedures and enable an organization to better identify and manage personally identifiable information in large-scale systems. For example, automated tools can greatly improve efforts to consistently normalize data or identify malformed data. Automated tools can also be used to improve the auditing of data and detect errors that may incorrectly alter personally identifiable information or incorrectly associate such information with the wrong individual. Automated capabilities backstop processes and procedures at-scale and enable more fine-grained detection and correction of data quality errors.

Determine if [Assignment: organization-defined automated mechanisms] are used to correct or delete personally identifiable information that is inaccurate, outdated, incorrectly determined regarding impact, or incorrectly de-identified.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; documentation addressing personally identifiable information quality operations; quality reports; maintenance logs; system audit records; audit findings; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for performing personally identifiable information quality inspections; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for personally identifiable information quality inspection; automated mechanisms supporting and/or implementing personally identifiable information quality operations.

SI-18(2) Data Tags

Baselines: Not in a baseline

Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.

Discussion and assessment objectives for SI-18(2)

Data tagging personally identifiable information includes tags that note processing permissions, authority to process, de-identification, impact level, information life cycle stage, and retention or last updated dates. Employing data tags for personally identifiable information can support the use of automation tools to correct or delete relevant personally identifiable information.

Determine if data tags are employed to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; procedures addressing data tagging; personally identifiable information inventory; system audit records; audit findings; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for tagging data; organizational personnel with information security and privacy responsibilities.

Test: Data tagging mechanisms; automated mechanisms supporting and/or implementing data tagging.

SI-18(3) Collection

Baselines: Not in a baseline

Collect personally identifiable information directly from the individual.

Discussion and assessment objectives for SI-18(3)

Individuals or their designated representatives can be sources of correct personally identifiable information. Organizations consider contextual factors that may incentivize individuals to provide correct data versus false data. Additional steps may be necessary to validate collected information based on the nature and context of the personally identifiable information, how it is to be used, and how it was obtained. The measures taken to validate the accuracy of personally identifiable information used to make determinations about the rights, benefits, or privileges of individuals under federal programs may be more comprehensive than the measures taken to validate less sensitive personally identifiable information.

Determine if personally identifiable information is collected directly from the individual.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; system configuration documentation; system audit records; user interface where personally identifiable information is collected; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for data collection; organizational personnel with information security and privacy responsibilities.

Test: Data collection mechanisms; automated mechanisms supporting and/or validating collection directly from the individual.

SI-18(4) Individual Requests

Baselines: Privacy

Correct or delete personally identifiable information upon request by individuals or their designated representatives.

Discussion and assessment objectives for SI-18(4)

Inaccurate personally identifiable information maintained by organizations may cause problems for individuals, especially in those business functions where inaccurate information may result in inappropriate decisions or the denial of benefits and services to individuals. Even correct information, in certain circumstances, can cause problems for individuals that outweigh the benefits of an organization maintaining the information. Organizations use discretion when determining if personally identifiable information is to be corrected or deleted based on the scope of requests, the changes sought, the impact of the changes, and laws, regulations, and policies. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding appropriate instances of correction or deletion.

Determine if personally identifiable information is corrected or deleted upon request by individuals or their designated representatives.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; system configuration; individual requests; records of correction or deletion actions performed; system audit records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for responding to individual requests for personally identifiable information correction or deletion; organizational personnel with information security and privacy responsibilities.

Test: Request mechanisms; automated mechanisms supporting and/or implementing individual requests for correction or deletion.

SI-18(5) Notice of Correction or Deletion

Baselines: Not in a baseline

Notify [Assignment: organization-defined recipients] and individuals that the personally identifiable information has been corrected or deleted.

Discussion and assessment objectives for SI-18(5)

When personally identifiable information is corrected or deleted, organizations take steps to ensure that all authorized recipients of such information, and the individual with whom the information is associated or their designated representatives, are informed of the corrected or deleted information.

Determine if [Assignment: organization-defined recipients] and individuals are notified when the personally identifiable information has been corrected or deleted.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; system configuration; individual requests for corrections or deletions; notifications of correction or deletion action; system audit records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for sending correction or deletion notices; organizational personnel with information security and privacy responsibilities.

Test: Organizational processes for notifications of correction or deletion; automated mechanisms supporting and/or implementing notifications of correction or deletion.

Assessment objectives (SP 800-53A)

Objectives and methods for SI-18

Determine if:

• SI-18a.
  • SI-18a.[01] the accuracy of personally identifiable information across the information life cycle is checked [Assignment: organization-defined frequency];
  • SI-18a.[02] the relevance of personally identifiable information across the information life cycle is checked [Assignment: organization-defined frequency];
  • SI-18a.[03] the timeliness of personally identifiable information across the information life cycle is checked [Assignment: organization-defined frequency];
  • SI-18a.[04] the completeness of personally identifiable information across the information life cycle is checked [Assignment: organization-defined frequency];
• SI-18b. inaccurate or outdated personally identifiable information is corrected or deleted.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; documentation addressing personally identifiable information quality operations; quality reports; maintenance logs; system audit records; audit findings; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for performing personally identifiable information quality inspections; organizational personnel with information security responsibilities; organizational personnel with privacy responsibilities.

Test: Organizational processes for personally identifiable information quality inspection; automated mechanisms supporting and/or implementing personally identifiable information quality operations.

Policy statement

• For a system that processes personally identifiable information, the System owner shall check the accuracy of the personally identifiable information across the information life cycle Fill in: the frequency at which to check the accuracy of personally identifiable information across the information life cycle Typical: at collection, and at least annually. (SI-18a)
• For such a system, the System owner shall check the relevance of the personally identifiable information across the information life cycle Fill in: the frequency at which to check the relevance of personally identifiable information across the information life cycle Typical: at least annually, with the review of the privacy impact assessment. (SI-18a)
• For such a system, the System owner shall check the timeliness of the personally identifiable information across the information life cycle Fill in: the frequency at which to check the timeliness of personally identifiable information across the information life cycle Typical: at least annually. (SI-18a)
• For such a system, the System owner shall check the completeness of the personally identifiable information across the information life cycle Fill in: the frequency at which to check the completeness of personally identifiable information across the information life cycle Typical: at collection, and at least annually. (SI-18a)
• For such a system, the System owner shall correct or delete inaccurate or outdated personally identifiable information. (SI-18b)

Federal systems

The Privacy Act requires each agency that maintains a system of records to maintain all records used in making any determination about an individual “with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination”, and, before disseminating a record to anyone other than an agency (except under subsection (b)(2)), to make reasonable efforts to assure it is accurate, complete, timely and relevant for agency purposes (5 U.S.C. § 552a(e)(5) and (e)(6)). As of September 2026.

• For each system of records, the System owner shall maintain records used in making determinations about individuals with the accuracy, relevance, timeliness and completeness 5 U.S.C. § 552a(e)(5) requires. (SI-18a)
• Before disseminating a record from a system of records to anyone other than an agency, except under 5 U.S.C. § 552a(b)(2), the System owner shall make reasonable efforts to assure the record is accurate, complete, timely and relevant for agency purposes. (SI-18a)

SI-18(4) Individual requests

• For a system that processes personally identifiable information, the System owner shall correct or delete personally identifiable information upon request by individuals or their designated representatives, once the request is verified and approved. (SI-18(4))
• The Senior privacy official shall ensure each request to correct or delete personally identifiable information is answered, and that a refusal is given in writing with the reason and how to appeal. (SI-18(4))

Federal systems

For records in a system of records, the Privacy Act lets an individual request amendment of a record about them. The agency must acknowledge the request in writing “not later than 10 days (excluding Saturdays, Sundays, and legal public holidays)” after receiving it, and then promptly either make the correction or tell the individual of its refusal, the reasons, and how to request a review. A review of a refusal must be completed within 30 days, excluding Saturdays, Sundays and legal public holidays, unless the agency head extends the period for good cause (5 U.S.C. § 552a(d)(2) and (d)(3)). Subsections (j) and (k) let an agency exempt some systems of records from these provisions by rule. As of September 2026.

• For each system of records, the Senior privacy official shall acknowledge each request to amend a record in writing within 10 days, excluding Saturdays, Sundays and legal public holidays, and then promptly correct the record or explain the refusal and how to request a review. (SI-18(4))
• The Senior privacy official shall complete the review of a refused amendment within 30 days, excluding Saturdays, Sundays and legal public holidays, unless the agency head extends the period for good cause. (SI-18(4))

From the System and Information Integrity Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

SI-18 asks you to check the accuracy, relevance, timeliness and completeness of personally identifiable information across its life cycle, at frequencies you set (a), and to correct or delete information that is inaccurate or outdated (b). SI-18 is in the SP 800-53B Privacy baseline only.

NIST’s SI-18 discussion describes quality operations as the steps that confirm the information is accurate and relevant from creation and collection through use, sharing and disposal. Its example is validating addresses as they are entered, using automated address verification look-up interfaces. Checking quality includes tracking changes to the data over time, so that when an error is found you know what changed and how. The measures depend on the nature and context of the information, how it was obtained and how it is used. Information used to make determinations about individuals’ rights, benefits or privileges may need more thorough checks than information used for less sensitive purposes.

SI-18 is the system-level side of PM-22, which sets the organization’s quality policies, the correction process and appeals.

Common implementations. The SI-18 clause of the System and Information Integrity policy (Privacy variant) has the system owner run the checks and correct or delete what is wrong. In practice:

• At collection: format and range validation, address verification, confirmation screens where individuals review what they entered, and collecting from the individual where possible rather than from third parties.
• Periodic checks: comparing records with an authoritative source, finding duplicates and incomplete records, and asking individuals to confirm their details.
• Relevance: checking that each data element still serves a purpose listed in the privacy impact assessment, and flagging records past their retention period (SI-12).
• An audit trail of changes to personally identifiable information, with who made each change and why.
• A defect workflow that corrects or deletes the record and, where the information was shared, passes the correction on (PM-22c).

Section 8 of the privacy impact assessment records how each system checks quality.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
How often accuracy is checked (a)	At collection, and at least annually
How often relevance is checked (a)	At least annually, with the review of the privacy impact assessment
How often timeliness is checked (a)	At least annually
How often completeness is checked (a)	At collection, and at least annually

These match the SI-18 clause. Check more often where the information drives decisions about individuals, as NIST’s discussion suggests.

Evidence assessors ask for.

• The quality checks the system runs, at collection and on a schedule, with the frequencies recorded in the privacy impact assessment
• Results of the last periodic checks, and the corrections and deletions they led to
• Validation rules and configuration for data entry
• The change history for a sample of records
• Records of corrections passed to recipients of shared information

Inheritance. The privacy office provides the policy and the correction procedure (PM-22) as program controls. The checks run in each system, on its own data, so SI-18 is usually system-specific, or hybrid where a shared service such as address verification is provided centrally.

Common findings.

• Validation at entry, with no later check, so information goes stale (a).
• Errors corrected in the main system but not in downstream copies, reports or shared data.
• No record of what changed, so an error cannot be traced or undone.
• Information kept past its retention period and still used.

Enhancements in the Privacy baseline. SI-18(4) individual requests: correct or delete personally identifiable information when individuals or their designated representatives ask. NIST’s discussion says inaccurate information can lead to inappropriate decisions or the denial of benefits and services, and that even correct information can sometimes cause problems that outweigh the benefit of keeping it. Organizations use discretion, based on the scope of the request, the change sought, its impact, and laws, regulations and policies, and staff consult the senior privacy official and legal counsel on when to correct or delete.

The SI-18(4) clause has the system owner correct or delete the information once the request is verified and approved, and the senior privacy official make sure each request is answered, with any refusal given in writing with the reason and how to appeal. SI-18(4) has no parameters. Typical choices, which your organization may set differently:

Choice	Typical value
How individuals ask	The route the privacy notice gives, in its section on seeing and correcting your information
Identity check before acting	The same verification used for access requests (AC-3(14))
Time to acknowledge and decide	Acknowledge within 10 working days; decide promptly, within 30 days (the PM-22 typical value)
Who hears appeals	An official senior to, and independent of, the first decision maker (PM-22d)

Assessors ask for a sample of requests with the identity check, the decision, the change made in the system and in shared copies, and any refusal letters. Common findings are corrections made in one system but not in others that hold the same information, and refusals with no reason or appeal route. Telling recipients and individuals about a correction is SI-18(5), which is in no baseline; PM-22c covers it as policy.

SI-18 has four other enhancements in no baseline: SI-18(1) automation support, SI-18(2) data tags, SI-18(3) collection directly from the individual and SI-18(5) notice of correction or deletion. None has a clause in the policy template.

Federal systems (as of October 2026). The Privacy Act (5 U.S.C. § 552a), subsection (e)(5), requires each agency to maintain records it uses in making any determination about an individual “with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination”. Under (e)(6), before disseminating a record to anyone other than an agency (except under (b)(2)), the agency makes reasonable efforts to assure it is accurate, complete, timely and relevant for agency purposes. OMB Circular A-130, main body section 5.f(1)(e), requires agencies, to the extent reasonably practicable, to “ensure that PII is accurate, relevant, timely, and complete”. Its Appendix II, section 3.e, lists Quality and Integrity among the Fair Information Practice Principles; the Circular says these principles “are not OMB requirements”.

For SI-18(4), subsection (d)(2) lets an individual request amendment of a record in a system of records. The agency acknowledges the request in writing within 10 days (excluding Saturdays, Sundays and legal public holidays), then promptly corrects the record or tells the individual of the refusal, the reason, and how to request a review. Under (d)(3), the review is completed within 30 days on the same count unless the agency head extends it for good cause; if the reviewing official also refuses, the individual may file a statement of disagreement. Under (c)(4), the agency informs past recipients of corrections and notations of dispute where it kept an accounting of the disclosure. The SI-18 and SI-18(4) clauses’ federal blocks carry these into the policy.

Artifacts

• System and Information Integrity Decision Worksheet
• System and Information Integrity Policy