CGRCC / requirement

ID.IM-P3

REQ-dc669e117a26fa10a033 · LEGACY_INTERPRETATION · source version fa004bbe5c530eee

Organization should inventory affected person categories

Meaning & implementation context

Catalog material requires organizational applicability review. Reported support, approval and maturity are statements from the source, not current enforcement verification.

Source Id: nist-privacy-1
Control: ID.IM-P3
Source Version: CSWP 10 / 1.0
Url: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24
Actor: Organization
Modality: should
Action: inventory
Object: affected person categories
Condition: Within the source scope; assess applicability before adoption.
Exception: Not recorded
Timing: Not recorded
Authority: voluntary
Jurisdiction: United States
Checked At: 2026-09-28
Status: interpretation-needs-review
Examples: { "meetsRule": "Organization follows the recommendation to \"inventory\" for affected person categories within these conditions: Within the source scope; assess applicability before adoption..", "doesNotMeetRule": "Organization omits the recommended action \"inventory\" for affected person categories. This is a recommendation gap, not by itself a statutory violation.", "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match." }

Source-reported relationships

1 associations retained with their original context.

SUPPORTED BY SOURCE REQUIREMENT · AIR-1C31FD0739@9438a27a13e45099

SOURCE_REPORTED_REVIEW_REQUIRED

{
  "sourceKey": "nist-privacy-1@1244c574bf2a",
  "locator": "ID.IM-P3"
}

Inspect target record ↗

Owner interpretation review

Append a catalog review decision. The source record remains immutable.

Review reason

Owner sign-in

Versioned CGRCC JSON

{
  "key": "REQ-dc669e117a26fa10a033@fa004bbe5c530eee",
  "id": "REQ-dc669e117a26fa10a033",
  "version": "fa004bbe5c530eee",
  "kind": "requirement",
  "lifecycle": "LEGACY_INTERPRETATION",
  "title": "ID.IM-P3",
  "statement": "Organization should inventory affected person categories",
  "family": "Data & IP",
  "body": {
    "sourceId": "nist-privacy-1",
    "control": "ID.IM-P3",
    "sourceVersion": "CSWP 10 / 1.0",
    "url": "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24",
    "actor": "Organization",
    "modality": "should",
    "action": "inventory",
    "object": "affected person categories",
    "condition": "Within the source scope; assess applicability before adoption.",
    "exception": null,
    "timing": null,
    "authority": "voluntary",
    "jurisdiction": "United States",
    "checkedAt": "2026-09-28",
    "status": "interpretation-needs-review",
    "examples": {
      "meetsRule": "Organization follows the recommendation to \"inventory\" for affected person categories within these conditions: Within the source scope; assess applicability before adoption..",
      "doesNotMeetRule": "Organization omits the recommended action \"inventory\" for affected person categories. This is a recommendation gap, not by itself a statutory violation.",
      "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
    }
  },
  "versions": [
    {
      "version": "fa004bbe5c530eee",
      "key": "REQ-dc669e117a26fa10a033@fa004bbe5c530eee"
    }
  ],
  "provenance": [],
  "relationships": [
    {
      "id": "MAP-640a25ec7be7ee7792e19c9a",
      "from": "AIR-1C31FD0739@9438a27a13e45099",
      "to": "REQ-dc669e117a26fa10a033@fa004bbe5c530eee",
      "kind": "SUPPORTED_BY_SOURCE_REQUIREMENT",
      "status": "SOURCE_REPORTED_REVIEW_REQUIRED",
      "body": {
        "sourceKey": "nist-privacy-1@1244c574bf2a",
        "locator": "ID.IM-P3"
      },
      "fromKeys": [
        "AIR-1C31FD0739@9438a27a13e45099"
      ],
      "toKeys": [
        "REQ-dc669e117a26fa10a033@fa004bbe5c530eee"
      ],
      "resolution": "RESOLVED_REFERENCE_REVIEW_REQUIRED"
    }
  ]
}

Back to CGRCC Registry