Key takeaways
- Hide or obscure sensitive data where full data isn't needed.
- Masking hides sensitive data from people and systems that do not need to see it.
- Start here: identify where sensitive data is displayed or used unnecessarily.
Purpose
Hide or obscure sensitive data where full data isn't needed.
Requirement
Requirement summaryData masking shall be used in accordance with the organization’s topic-specific policy on access control and other related topic-specific policies, and business requirements, taking applicable legislation into consideration.
Why it matters
Masking hides sensitive data from people and systems that do not need to see it.
How to implement
- Identify where sensitive data is displayed or used unnecessarily.
- Apply masking, pseudonymisation or anonymisation.
- Use masked data in testing and analytics.
- Check masking cannot be easily reversed.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.11. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for hiding or scrambling sensitive data (data masking) where full data isn't needed.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.11 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Examples of masked data in test systems or reports.
- Approvals for any exceptions where real data was used.
- A list of which data fields must be masked.
Things you should be able to show or explain
- Be able to show masked data in a test environment.
How much to show: One or two test data sets.
Common mistakes
- Real personal data used in testing.
- No rules on what to mask.
- Full production data in test systems.
- Support staff seeing full card numbers.
- Tip: Mask production data before using it in test.
Policies & documents to have
- Data Management Policy
FAQ
Is A.8.11 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.11?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for hiding or scrambling sensitive data (data masking) where full data isn't needed…