{
  "node_id": "nist-800-122-pii",
  "title": "Protecting PII (NIST 800-122)",
  "domain": "Legal & IP Sovereignty",
  "version": "1.1.0",
  "last_updated": "2026-04-10",
  "bluf": "NIST Special Publication 800-122 (Guide to Protecting the Confidentiality of Personally Identifiable Information) provides a comprehensive framework for federal agencies and their contractors to identify, categorize, and protect PII held in information systems - establishing that PII protection must be risk-based, proportional to the sensitivity of the information and the likelihood and impact of unauthorized disclosure. The publication defines PII as any information that can be used to distinguish or trace an individual's identity, either alone or when combined with other personal or identifying information, and categorizes PII confidentiality impact using the NIST FIPS 199 LOW/MODERATE/HIGH scale based on factors including identifiability, quantity, data field sensitivity, context of use, and obligations to protect. Organizations that fail to implement PII protection controls consistent with NIST 800-122 face federal enforcement action under the Privacy Act of 1974, the E-Government Act of 2002, OMB Memorandum M-17-12, and sector-specific privacy statutes. AI agents that process, store, or transmit PII must apply the full NIST 800-122 control framework, including de-identification, access control, and incident response requirements.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "ai_overlay_2026",
      "industry_mapping"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-sp-800-53-r5",
    "iso-27701-privacy-information-management",
    "gdpr-article-5-data-principles"
  ],
  "primary_citations_count": 5
}