Document Data Flows

frameworkCIS Controls v8.1 section3. Data Protection csf 2.0ID.AM-03 ID.AM-05 ID.AM-07 topicsData Classification frameworks0 9 2

Official text · not licensableSafeguard title © CIS (CC BY-NC-ND 4.0). See CIS Controls v8.1 for details.

gap from CIS v8.1 → gap to CIS v8.1 →

Wrong or missing mapping? Report it

Equivalents of CIS 3.8 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-05 ID.AM-07	Assets are prioritized based on classification, criticality, resources, and impact on the mission; Inventories of data and corresponding metadata for designated data types are maintained	Editorial	Same topic: Data Classification (editorial pick) 1 loosely related (not mappings) ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained Loosely related Only shares CSF ID.AM-03: related, not a mapping
ISO 27001	A.5.12 A.5.13	Classification of information; Labelling of information	Editorial	Same topic: Data Classification (editorial pick) 5 loosely related (not mappings) A.5.14 Information transfer Loosely related Only shares CSF ID.AM-03: related, not a mapping A.8.20 Networks security Loosely related Only shares CSF ID.AM-03: related, not a mapping A.8.21 Security of network services Loosely related Only shares CSF ID.AM-03: related, not a mapping A.8.22 Segregation of networks Loosely related Only shares CSF ID.AM-03: related, not a mapping A.5.9 Inventory of information and other associated assets Loosely related Only shares CSF ID.AM-05, ID.AM-07: related, not a mapping
SOC 2	C1.1	Identifying and protecting confidential information	Editorial	Same topic: Data Classification (editorial pick) 1 loosely related (not mappings) CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF ID.AM-03: related, not a mapping
PCI DSS	9.4.2	Media classified by data sensitivity	Editorial	Same topic: Data Classification (editorial pick) 15 loosely related (not mappings) 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF ID.AM-03, ID.AM-07: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF ID.AM-03: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF ID.AM-03: related, not a mapping 1.2.1 Configuration standards for network security controls Loosely related Only shares CSF ID.AM-03: related, not a mapping 1.3.1 Inbound traffic to the CDE restricted Loosely related Only shares CSF ID.AM-03: related, not a mapping 1.4.1 Network controls between trusted and untrusted networks Loosely related Only shares CSF ID.AM-03: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Loosely related Only shares CSF ID.AM-07: related, not a mapping 3.4.1 PAN masked when displayed Loosely related Only shares CSF ID.AM-07: related, not a mapping …and 7 more in the downloads
CMMC	MP.L2-3.8.4	Media Markings	Editorial	Same topic: Data Classification (editorial pick) 1 loosely related (not mappings) CA.L2-3.12.4 System Security Plan Loosely related Only shares CSF ID.AM-03: related, not a mapping
800-53	RA-2	Security Categorization	Editorial	Same topic: Data Classification (editorial pick) 11 loosely related (not mappings) AC-4 Information Flow Enforcement Loosely related Only shares CSF ID.AM-03: related, not a mapping CA-3 Information Exchange Loosely related Only shares CSF ID.AM-03: related, not a mapping CA-9 Internal System Connections Loosely related Only shares CSF ID.AM-03: related, not a mapping PL-2 System Security and Privacy Plans Loosely related Only shares CSF ID.AM-03: related, not a mapping PL-8 Security and Privacy Architectures Loosely related Only shares CSF ID.AM-03: related, not a mapping PM-7 Enterprise Architecture Loosely related Only shares CSF ID.AM-03: related, not a mapping CM-12 Information Location Loosely related Only shares CSF ID.AM-07: related, not a mapping CM-13 Data Action Mapping Loosely related Only shares CSF ID.AM-07: related, not a mapping …and 3 more in the downloads
HIPAA	§164.308(a)(1)(ii)(B)§164.316(a)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(A)	Risk Management; Policies and Procedures…	Loosely related	No mapping. Only shares CSF ID.AM-03, ID.AM-05: related, not a mapping +14 more loosely related (not mappings) §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF ID.AM-03: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF ID.AM-03: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF ID.AM-03: related, not a mapping §164.310(a)(2)(ii) Facility Security Plan Loosely related Only shares CSF ID.AM-03: related, not a mapping …and 10 more in the downloads
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	12.1	Asset classification	Editorial	Same topic: Data Classification (editorial pick) 2 loosely related (not mappings) 12.4 Asset inventory Loosely related Only shares CSF ID.AM-03, ID.AM-07: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF ID.AM-03: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.8(1)	Identification	Editorial	Same topic: Data Classification (editorial pick) 1 loosely related (not mappings) Art.9(4)(b) Protection and prevention Loosely related Only shares CSF ID.AM-03: related, not a mapping
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Editorial	Same topic: Data Classification (editorial pick)
Cyber Essentials	CE 1	Firewalls	Loosely related	No mapping. Only shares CSF ID.AM-03: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.