CIS Control 3 Safeguards for data: the data management process, data inventory, access control lists, retention, disposal, classification, data flows, encryption, segmentation, data loss prevention and logging of sensitive data access.
The documented data management process the rest of Control 3 builds on: sensitivity, ownership, handling, retention limits and disposal, reviewed annually. CIS v8.1 assigns it to the Govern function.
An inventory of enterprise data, sensitive data at a minimum, built from the data management process and reviewed at least annually: how it differs from the asset and software inventories and how its completeness is measured.
Need-to-know access permissions on databases, applications and file systems, local or remote: the data-level access layer, distinct from the account-level controls in Controls 5 and 6.
Keeping data only as long as the documented data management process allows, with both minimum and maximum retention timelines, and how assessors check retention rules per sensitivity type.
Disposing of data as the data management process requires, with disposal methods matched to sensitivity: what disposal evidence looks like and how assessors measure it per sensitive data type.
Encryption of end-user devices that hold sensitive data, the only encryption Safeguard in Control 3 that applies from IG1, with examples such as BitLocker, FileVault and dm-crypt.
An enterprise-wide classification scheme with labels like Public, Confidential and Sensitive, reviewed annually: the IG2 Safeguard that turns sensitivity levels from the data management process into labels applied to data.
Documenting how data moves, including flows to and from service providers, based on the data management process and reviewed annually, with assessors checking coverage of data flows to external enterprises.
Encryption of data written to removable media: a one-line IG2 Safeguard measured by coverage across enterprise assets.
Encrypting sensitive data as it moves across networks, with TLS and OpenSSH as CIS's examples, and the links CIS draws to data-in-transit requirements in NIST CSF 2.0, NIST SP 800-53 and PCI DSS.
Encrypting stored sensitive data in servers, applications and databases: storage-layer encryption as the minimum, application-layer encryption as the stronger option.
Separating where data is processed and stored according to its sensitivity, so sensitive data is not handled on assets meant for lower-sensitivity data; measured with the data inventory and architecture diagrams.
Automated data loss prevention tooling (host-based DLP, for example) that discovers sensitive data across enterprise assets and service providers and keeps the data inventory current: an IG3 Safeguard.
Audit logging of access to sensitive data, including modification and disposal: the Control 3 Safeguard in the Detect function, linking data protection to audit log management in Control 8.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.