Data Security Pattern
Data security pattern to define security controls required to secure data or information processed by business services
Click on controls in the diagram to view details. Download SVG
When to Use
Organizations who process Personally Identifiable Information (PII), are in regulated sectors (Health, Finance, Government etc) or process commercially sensitive information.
When NOT to Use
Publically available information, freely available from many sources.
Typical Challenges
Management appetite. Selling in the organisation. Keeping it simple, and cutting through the complexity of environment. Building the right awareness and training campaign. Looking forward, the challenges to maintain data security are likely to get harder. The pace of technological change is quickening. The level and sophistication of external threats, such as e-crime, is increasing. Improving services will mean greater use of data within organisations and more data sharing.
Threat Resistance
To be determined.
Assumptions
None.
Mapped Controls (33)
- AC-02 Account Management
- AC-03 Access Enforcement
- AC-04 Information Flow Enforcement
- AC-05 Separation Of Duties
- AC-06 Least Privilege
- AC-15 Automated Marking
- AC-16 Automated Labeling
- AC-20 Use Of External Information Systems
- AT-02 Security Awareness
- AT-03 Security Training
- CA-07 Continuous Monitoring
- CP-09 Information System Backup
- IA-02 User Identification And Authentication
- MP-02 Media Access
- MP-03 Media Labeling
- MP-04 Media Storage
- MP-05 Media Transport
- MP-06 Media Sanitization And Disposal
- PE-03 Physical Access Control
- PE-19 Information Leakage
- PL-05 Privacy Impact Assessment
- RA-01 Risk Assessment Policy And Procedures
- RA-02 Security Categorization
- RA-03 Risk Assessment
- RA-04 Risk Assessment Update
- SC-04 Information Remnance
- SC-07 Boundary Protection
- SC-08 Transmission Integrity
- SC-09 Transmission Confidentiality
- SC-13 Use Of Cryptography
- SI-09 Information Input Restrictions
- SI-10 Information Accuracy, Completeness, Validity, And Authenticity
- SI-12 Information Output Handling And Retention