ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained

Threats Addressed:

Information Disclosure

Subcategory is new to this version of the framework.

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

1st: 1st Party Risk

Ex1: Maintain a list of the designated data types of interest (e.g., personally identifiable information, protected health information, financial account numbers, organization intellectual property, operational technology data)

Ex2: Continuously discover and analyze ad hoc data to identify new instances of designated data types

Ex3: Assign data classifications to designated data types through tags or labels

Ex4: Track the provenance, data owner, and geolocation of each instance of designated data types

NIST Special Publication 800-53 Revision 5.2.0

CM-12: Information Location

Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored; Identify and document the users who have access to the system and system components where the information is processed and stored; and Document changes to the location (i.e., system or system components) where…

CM-13: Data Action Mapping

Develop and document a map of system data actions.

SI-12: Information Management and Retention

Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.

NIST SP 800-171 Revision 3.0

03.14.08: Information Management and Retention

Manage and retain CUI within the system and CUI output from the system in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.

Cloud Controls Matrix v4.0

DSP-01: Security and Privacy Policy and Procedures

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the classification, protection and handling of data throughout its lifecycle, and according to all applicable laws and regulations, standards, and risk level. Review and update the policies and procedures at least annually.

DSP-03: Data Inventory

Create and maintain a data inventory, at least for any sensitive data and personal data.

DSP-04: Data Classification

Classify data according to its type and sensitivity level.

DSP-06: Data Ownership and Stewardship

Document ownership and stewardship of all relevant documented personal and sensitive data. Perform review at least annually.

DSP-10: Sensitive Data Transfer

Define, implement and evaluate processes, procedures and technical measures that ensure any transfer of personal or sensitive data is protected from unauthorized access and only processed within scope as permitted by the respective laws and regulations.

DSP-19: Data Location

Define and implement, processes, procedures and technical measures to specify and document the physical locations of data, including any locations in which data is processed or backed up.

UEM-02: Application and Service Approval

Define, document, apply and evaluate a list of approved services, applications and sources of applications (stores) acceptable for use by endpoints when accessing or storing organization-managed data.

Critical Security Controls Version 8.1

3.2: Establish and Maintain a Data Inventory

Establish and maintain a data inventory, based on the enterprise's data management process. Inventory sensitive data, at a minimum. Review and update inventory annually, at a minimum, with a priority on sensitive data.