Data Action Mapping

frameworkNIST SP 800-53 Rev 5.2 sectionCM Configuration Management csf 2.0ID.AM-07 ID.AM-08 topics— frameworks0 0 0

Official textDevelop and document a map of system data actions.NIST SP 800-53 Rev 5.2 control statement (public domain)

Wrong or missing mapping? Report it

Equivalents of CM-13 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-07 ID.AM-08	Inventories of data and corresponding metadata for designated data types are maintained; Systems, hardware, software, services, and data are managed throughout their life cycles	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
ISO 27001	A.5.9 A.5.8 A.5.11 A.5.12	Inventory of information and other associated assets; Information security in project management…	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping +6 more loosely related (not mappings) A.5.13 Labelling of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.AM-08: related, not a mapping A.7.10 Storage media Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 2 more in the downloads
CIS v8.1	CIS 1.1 CIS 3.2 CIS 3.5 CIS 1.2	Establish and Maintain Detailed Enterprise Asset Inventory; Establish and Maintain a Data Inventory…	Loosely related	No mapping. Only shares CSF ID.AM-08, ID.AM-07: related, not a mapping +7 more loosely related (not mappings) CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 3 more in the downloads
SOC 2	C1.1 CC6.1	Identifying and protecting confidential information; Logical access security over information assets	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
PCI DSS	3.2.1 3.4.1 3.4.2 6.2.1	Account data storage minimised, with retention and disposal; PAN masked when displayed…	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping +11 more loosely related (not mappings) 6.2.2 Developers trained in secure software development Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3.1 Manual code reviews approved by someone else Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.4 Coding techniques prevent common software attacks Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 7 more in the downloads
CMMC	CA.L2-3.12.4 MA.L2-3.7.1 MA.L2-3.7.3 SC.L2-3.13.2	System Security Plan; Perform Maintenance…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping +1 more loosely related (not mappings) MP.L2-3.8.4 Media Markings Loosely related Only shares CSF ID.AM-07: related, not a mapping
HIPAA	§164.316(b)(2)(i)§164.308(a)(1)(ii)(B)§164.308(b)(4)§164.310(a)(2)(ii)	Time Limit; Risk Management…	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping +10 more loosely related (not mappings) §164.310(a)(2)(iv) Maintenance Records Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 6 more in the downloads
GDPR	Art.30(1)	Records of processing activities	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
NIS2	12.4 6.2	Asset inventory; Secure development life cycle	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping
DORA	Art.8(1)Art.8(4)Art.8(6)	Identification; Identification…	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Loosely related	No mapping. Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping
Cyber Essentials	CE 3	Security Update Management	Loosely related	No mapping. Only shares CSF ID.AM-08: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.