A.8.11 Data masking
Use data masking in line with access policy, business need and applicable law.
12
artefacts
2
held by a system
4
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Masking rule set configuration files · Cloud console / configuration management
- System logs showing masking applied · SIEM / log platform
periodic reviewEvidence produced at each review
- Change management records for masking tool deployment · SIEM / log platform
- Test results of masking validation · SIEM / log platform
- Periodic access review reports for masked data · Identity provider / directory
- Exception approval records · Identity provider / directory
governing documentDocuments that govern the control
- Data Masking Policy document · Policy repository / GRC workspace
- Approved masking procedures · Policy repository / GRC workspace
- Policy change log · Policy repository / GRC workspace
- Data classification matrix linking to masking rules · Policy repository / GRC workspace
- Sample masked data extracts · Policy repository / GRC workspace
- User role matrix with masking permissions · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 2 system-held artefacts from your Cloud console / configuration management on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Masking applied inconsistently across data stores
- Lack of documented justification for masking decisions
- Failure to review and update masking rules
- Insufficient monitoring of masking effectiveness
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.8.10 Information deletion · A.8.12 Data leakage prevention