DIA-1 - Data Inventory
Control for registering and classifying the organization's data inventory
Control Definition
A complete, up-to-date catalog of all data the organization collects, processes, stores and transmits must be maintained, classified according to its sensitivity and criticality. The discovery and classification of sensitive data must be automated, the results validated with their owners, and the classification used as the basis for applying differentiated security controls. For each type of data, its owner, location and retention period must be recorded, and the catalog kept up to date whenever anything changes.
Requirements
Requirement 1
We maintain a complete, up-to-date catalog of all data the organization collects, processes, stores and transmits.
Requirement 2
We classify data according to its sensitivity and criticality into four levels: public, internal, confidential and restricted.
Requirement 3
For each type of data we record: owner, technical custodian, source system, location, applicable regulations and retention period.
Requirement 4
We use classification labels as the basis for applying differentiated security controls.
Requirement 5
We define the data owner's responsibilities regarding protection, access and retention.
Requirement 6
We implement tools for the automatic discovery and classification of sensitive data in structured and unstructured repositories.
Requirement 7
We periodically validate automatically classified data with its owners.
Requirement 8
We update the catalog for new projects and review it in full on a scheduled basis.