CM-13 is a single sentence. Develop and document a map of system data actions. It sits in the Configuration Management family but serves privacy risk assessment.
800-53 binds US federal systems and others by contract. For a small or mid size company it is a reference that lines up well with privacy impact work.
What it means in practice
NIST defines data actions as system operations that process personally identifiable information, across the full life cycle of collection, generation, transformation, use, disclosure, retention and disposal. The map holds the discrete data actions, the PII elements in each, the system components involved and the owners or operators of those components.
The guidance says the level of detail can vary and the map can overlay any design artifact you already use. It also says building it may need coordination between privacy and security teams.
Evidence to collect
- The data action map itself, dated and owned.
- For each action, the PII elements and the components that touch them.
- Named owners or operators, including third parties.
- Evidence the map was reviewed with both privacy and security staff.
Common gaps
- The map covers collection and misses disclosure, retention and disposal.
- Third party processors are left off.
- It was built for one audit and not maintained.
How to implement it
Pick one product flow, such as signup, and list each step that touches personal data. Record elements, components and owners. Reuse the diagram you already have. Review it when the flow changes.
Quick check
What does a data action map include?
Discrete data actions, the PII elements processed, the system components involved and the owners or operators of those components.
