Control #
D
3
.
2
Require vendors to implement PII controls and data minimization
Vendors must implement technical and policy controls to minimize, redact, or block processing of personally identifiable information (PII). Review their practices for effectiveness and legal alignment.
Evidence
We'll list specific evidence that demonstrates compliance with this control. Typically, this is screenshots, proof of a legal or operational policy, or product demonstrations.
Recommended actions
We'll recommend specific practices and actions for complying with this control.