# NIST PF CONTROL Function — Assessment Template

## CT.DM — Data Management Assessment

### Data Subject Rights Capability

| Right | System Capability | Automated? | Avg Response Time | Status |
|-------|------------------|------------|-------------------|--------|
| Access (CT.DM-P1) | | Yes / No | | |
| Portability (CT.DM-P2) | | Yes / No | | |
| Rectification (CT.DM-P3) | | Yes / No | | |
| Erasure (CT.DM-P4) | | Yes / No | | |

### Retention Schedule Compliance

| Data Category | Retention Period | Automated Purge | Last Audit | Compliance |
|--------------|-----------------|-----------------|-----------|------------|
| | | Yes / No | | |

### Audit Logging

| Event Type | Logged? | Fields Captured | Retention Period | Review Frequency |
|-----------|---------|-----------------|-----------------|------------------|
| Data access | | | | |
| Data modification | | | | |
| Data deletion | | | | |
| Consent changes | | | | |

## CT.PO — Disassociated Processing

### De-identification Inventory

| Dataset | Technique | Parameters | Last Assessed | Re-identification Risk |
|---------|-----------|-----------|---------------|----------------------|
| | | | | Low / Medium / High |

## Sign-Off

| Role | Name | Date |
|------|------|------|
| Privacy Engineer | | |
| Data Steward | | |
| CPO/DPO | | |