The organization defines the frequency, minimally annually, for conducting reviews of its personally identifiable information (PII) holdings.
No STIG checks reference this CCI.