Segment Data Processing and Storage Based on Sensitivity

frameworkCIS Controls v8.1 section3. Data Protection csf 2.0PR.DS-01 PR.DS-02 PR.DS-10 PR.IR-01 topicsData Protection frameworks0 11 0

Official text · not licensableSafeguard title © CIS (CC BY-NC-ND 4.0). See CIS Controls v8.1 for details.

gap from CIS v8.1 → gap to CIS v8.1 →

Wrong or missing mapping? Report it

Equivalents of CIS 3.12 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.DS-01 PR.DS-02 PR.DS-10	The confidentiality, integrity, and availability of data-at-rest are protected; The confidentiality, integrity, and availability of data-in-transit are protected…	Editorial	Same topic: Data Protection (editorial pick) 1 loosely related (not mappings) PR.IR-01 Networks and environments are protected from unauthorized logical access and usage Loosely related Only shares CSF PR.IR-01: related, not a mapping
ISO 27001	A.5.14 A.8.10 A.8.11	Information transfer; Information deletion…	Editorial	Same topic: Data Protection (editorial pick) 32 loosely related (not mappings) A.8.22 Segregation of networks Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping A.8.20 Networks security Loosely related Only shares CSF PR.DS-02, PR.IR-01: related, not a mapping A.8.21 Security of network services Loosely related Only shares CSF PR.IR-01: related, not a mapping A.8.23 Web filtering Loosely related Only shares CSF PR.IR-01: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.15 Access control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 24 more in the downloads
SOC 2	C1.2 CC6.5	Disposing of confidential information; Protection of data when assets are disposed of	Editorial	Same topic: Data Protection (editorial pick) 5 loosely related (not mappings) CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.IR-01: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF PR.DS-02: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF PR.IR-01: related, not a mapping
PCI DSS	3.2.1 3.3.1 3.4.1	Account data storage minimised, with retention and disposal; Sensitive authentication data not kept after authorisation…	Editorial	Same topic: Data Protection (editorial pick) 34 loosely related (not mappings) 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF PR.IR-01: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF PR.IR-01: related, not a mapping 5.2.1 Anti-malware deployed on system components Loosely related Only shares CSF PR.IR-01: related, not a mapping 5.2.2 Anti-malware detects, removes or contains known malware Loosely related Only shares CSF PR.IR-01: related, not a mapping 5.2.3 Systems without anti-malware periodically re-evaluated Loosely related Only shares CSF PR.IR-01: related, not a mapping 5.2.3.1 Re-evaluation frequency set by targeted risk analysis Loosely related Only shares CSF PR.IR-01: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF PR.IR-01: related, not a mapping 11.2.1 Wireless access points detected and unauthorised ones handled Loosely related Only shares CSF PR.IR-01: related, not a mapping …and 26 more in the downloads
CMMC	MP.L2-3.8.3 SC.L2-3.13.16	Media Disposal; Data at Rest	Editorial	Same topic: Data Protection (editorial pick) 24 loosely related (not mappings) SC.L2-3.13.1 Boundary Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping SC.L2-3.13.4 Shared Resource Control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping SC.L2-3.13.6 Network Communication by Exception Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping AC.L2-3.1.2 Transaction & Function Control Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping AC.L2-3.1.3 Control CUI Flow Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping …and 16 more in the downloads
800-53	SC-8 SC-28 SI-7	Transmission Confidentiality and Integrity; Protection of Information at Rest…	Editorial	Same topic: Data Protection (editorial pick) 31 loosely related (not mappings) SC-4 Information in Shared System Resources Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping SC-7 Boundary Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping AC-3 Access Enforcement Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping AC-4 Information Flow Enforcement Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping SC-5 Denial-of-service Protection Loosely related Only shares CSF PR.IR-01: related, not a mapping CA-3 Information Exchange Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-7(10) Prevent Exfiltration Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-13 Cryptographic Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 23 more in the downloads
HIPAA	§164.310(d)(2)(i)§164.312(c)	Disposal; Integrity	Editorial	Same topic: Data Protection (editorial pick) 23 loosely related (not mappings) §164.308(a)(3) Workforce Security Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping §164.310(b) Workstation Use Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping §164.312(a) Access Control Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping §164.312(a)(2)(i) Unique User Identification Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF PR.DS-10, PR.IR-01: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 15 more in the downloads
GDPR	Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)	Principles relating to processing of personal data; Principles relating to processing of personal data…	Editorial	Same topic: Data Protection (editorial pick) 3 loosely related (not mappings) Art.32(1)(a) Security of processing Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF PR.IR-01: related, not a mapping
NIS2	12.2 12.3	Handling of assets; Removable media policy	Editorial	Same topic: Data Protection (editorial pick) 3 loosely related (not mappings) 6.7 Network security Loosely related Only shares CSF PR.IR-01: related, not a mapping 6.8 Network segmentation Loosely related Only shares CSF PR.IR-01: related, not a mapping 9.1 Cryptography Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping
Essential Eight	ISM-1488	Microsoft Office macros in files originating from the internet are blocked	Loosely related	No mapping. Only shares CSF PR.DS-02: related, not a mapping
DORA	Art.9(2)Art.9(3)(c)Art.9(3)(d)	Protection and prevention; Protection and prevention…	Editorial	Same topic: Data Protection (editorial pick) 5 loosely related (not mappings) Art.9(3)(a) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(4)(b) Protection and prevention Loosely related Only shares CSF PR.IR-01: related, not a mapping Art.28(8) General principles Loosely related Only shares CSF PR.IR-01: related, not a mapping Art.30(2) Key contractual provisions Loosely related Only shares CSF PR.IR-01: related, not a mapping
CPS 234	Para 21	Timely controls commensurate with risk and asset life-cycle	Editorial	Same topic: Data Protection (editorial pick)
Cyber Essentials	CE 1 CE 4	Firewalls; User Access Control	Loosely related	No mapping. Only shares CSF PR.IR-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.