Requirement
"The organization shall identify and meet the requirements regarding the preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements."[1]
Explanation
Determine if the organization has legal or other contractual requirements to protect PII and other privacy related data. Identify where the data is located and ensure that it is protected by the organization's security controls.
