8.11 Data masking
Data masking is to be applied as directed by the access control policy, related topic policies and what the business needs, with applicable law taken into account. Purpose: reduce how far sensitive data such as PII is exposed, and meet legal, regulatory and contractual obligations. Guidance: where protecting sensitive data such as PII matters, consider concealing it through masking, pseudonymization or anonymization, which can hide PII, obscure who the PII principals really are or other sensitive details, and break the link between the data and the person or other sensitive information. Verify that pseudonymization or anonymization is adequate; anonymization must address every element of the information, since a person can be identified indirectly through remaining data even when direct identifiers are removed. Other masking techniques include encryption with keys held by authorized users, nulling or deleting characters, varying numbers and dates, substituting values, and replacing values with hashes. When implementing masking consider: showing each user only the minimum data needed through designed queries and masks; obfuscating certain records within a data set where parts of the data are to stay hidden, for example allowing only specific roles to see a patient's records when clinically useful; letting PII principals require that users cannot even tell data has been obfuscated; and legal or regulatory requirements such as masking payment card data in processing or storage. When using these techniques consider the strength suited to how the data will be used, access controls on the processed data, agreements or restrictions on its use, prohibiting combining it with other information to re-identify the PII principal, and tracking who provides and receives it. Other information: anonymization irreversibly prevents direct or indirect identification; pseudonymization substitutes an alias, and whoever knows the algorithm or additional information can re-identify to some degree, so that must be kept separate and protected, though pseudonymized data is often more useful for statistics; masking can be static, dynamic or on-the-fly; hashing PII for anonymization should always be salted to resist enumeration; PII should be kept out of identifiers such as file names and URLs or anonymized there; ISO/IEC 27018 and ISO/IEC 20889 give more.
Source: ISO/IEC 27002:2022, 8.11. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Masking configurations in applications, databases and reports showing minimum necessary data displayed per role · Identity provider / directory
periodic reviewEvidence produced at each review
- Verification or re-identification risk assessments demonstrating that anonymization or pseudonymization is adequate · Data governance / DLP tooling
- Evidence of legally required masking, for example of payment card numbers in storage and display · Data governance / DLP tooling
- Agreements restricting use of masked or pseudonymized data sets and prohibiting re-identification, with records of who supplied and received them · Vendor register / contract repository
governing documentDocuments that govern the control
- Policy or standard specifying where masking, pseudonymization or anonymization is required, based on access control policy, business needs and law · Policy repository / GRC workspace
- Protection and separation of pseudonymization keys or additional information · Policy repository / GRC workspace
First move
Common gaps auditors find
- Data labelled as anonymized can be re-identified by combining remaining fields
- Hashes of identifiers are unsalted and easily reversed by enumeration
- Pseudonymization keys are stored alongside the pseudonymized data
- Full production data is visible to all users of support and reporting tools
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet