DIA-4 - Information and Data Cybersecurity
Control for protecting data confidentiality, integrity and availability
Control Definition
The organization's data must be protected against unauthorized access, modification, disclosure or destruction, applying access controls and encryption according to its classification. Sensitive data must be masked or removed in non-production environments, information leakage prevented through monitoring and blocking tools, and each data owner's responsibilities for its protection and access defined, including handling requests from third parties or authorities. Acceptable use rules and information handling procedures must be established, information classified and labeled consistently, and formal rules and agreements defined for its transfer, protecting the organization's records against loss or improper disclosure.
Requirements
Requirement 1
We protect the organization's data against unauthorized access, modification, disclosure or destruction.
Requirement 2
We prohibit the use of real production data in development or test environments without protection applied.
Requirement 3
We establish formal procedures for data access requests from authorities or third parties.
Requirement 4
We identify the rules for the acceptable use of information and related assets.
Requirement 5
We document the rules for the acceptable use of information and related assets.
Requirement 6
We apply the rules for the acceptable use of information and related assets.
Requirement 7
We identify the procedures for properly managing and handling information and related assets.
Requirement 8
We document the procedures for properly managing and handling information and related assets.
Requirement 9
We apply the procedures for properly managing and handling information and related assets.
Requirement 10
We classify information according to how confidential, intact and available it must be, taking into account the organization's security needs and what interested parties expect.
Requirement 11
We develop appropriate procedures for labeling information according to the defined classification scheme.
Requirement 12
We apply the procedures for labeling information according to the defined classification scheme.
Requirement 13
We have clear rules for transferring information through any medium, both within the organization and to other external parties.
Requirement 14
We have clear procedures for transferring information through any medium, both within the organization and to other external parties.
Requirement 15
We have formal agreements for transferring information through any medium, both within the organization and to other external parties.
Requirement 16
We protect the organization's records against loss, destruction, falsification, unauthorized access and improper disclosure.
Requirement 17
We implement access controls based on data classification (RBAC/ABAC) for confidential and restricted data.
Requirement 18
We encrypt sensitive data at rest and in transit.
Requirement 19
We mask or pseudonymize personal and sensitive data before using it in non-production environments.
Requirement 20
We implement DLP solutions on endpoints and corporate email to detect and block the unauthorized transmission of sensitive data.
Requirement 21
We monitor access to critical data through User and Entity Behavior Analytics (UEBA) with alerts on anomalous behavior.