SA-4(12): Data Ownership
Control Family:
Parent Control:
CSF v2.0 References:
Baselines:
- OT Low (SP 800-82r3)
- OT Moderate (SP 800-82r3)
- OT High (SP 800-82r3)
Control is new to this version of the control set.
Control Statement
- Include organizational data ownership requirements in the acquisition contract; and
- Require all data to be removed from the contractor’s system and returned to the organization within [Assignment: organization-defined time frame].
Supplemental Guidance
Contractors who operate a system that contains data owned by an organization initiating the contract have policies and procedures in place to remove the data from their systems and/or return the data in a time frame defined by the contract.
OT Baseline Rationale
Rationale for adding to Low, Mod, High baselines: Organizationally sensitive or proprietary OT data is often provided to contractors for project development or support, so data ownership should be defined prior to exchanging data with a vendor or integrator. The potential sharing of data with other parties and the potential deletion of the data after project completion should be determined. OT systems that are operated by contractors on behalf of the organization may be subject to the same requirements (e.g., legal, regulatory, etc.) for data ownership and retention.