What a CIS data management policy template must contain
The CIS policy template for Control 3 is an IG1 template, and Safeguard 3.1 asks for a written data management process that covers five elements: data sensitivity, data owners, handling guidance, retention limits by sensitivity and disposal requirements by sensitivity. The process must be reviewed once a year or after significant enterprise changes. If you have been asked to show a CIS data management policy template in place, start by confirming that your document addresses all five elements in writing, because the assessment specification scores Safeguard 3.1 as failing when no data management process exists and rates completeness against those five elements.
The template gives you a structure, not your answers. The actual content depends on your own sensitivity and retention standards: which data classes you recognize, who owns each class, how long each class may be kept, and how each must be destroyed. Your organization owns the policy and the decisions inside it. An implementation partner can help draft the document, map it to your systems and collect the supporting records, but only an independent assessor tests whether the policy is followed and reports on it. Before you start drafting, ask your legal, records and business owners to agree on the sensitivity levels, since every other element of the policy depends on them.
Check the policy against the assessment specification's five elements and confirm that the retention and disposal sections name specific sensitivity levels rather than generic statements. Keep a dated approval record and a log of each annual review, because the review cycle is part of what an assessor will ask to see. Then compare your document with the Safeguard-level expectations for retention, disposal and encryption on end-user devices, which the later sections of this page cover in detail.
How retention, disposal and encryption rules are written and tested
Safeguards 3.4, 3.5 and 3.6 turn the data management policy into operating rules: how long data is kept, how it is destroyed and how data on laptops and phones is protected. The organization sets the actual timelines, methods and encryption standards, and an assessor checks that the documented rules exist and are followed.
Minimum and maximum retention
Safeguard 3.4 asks the enterprise to retain data according to its documented process, and that covers both how long data must be kept and how long it may be kept. Write one retention period per sensitivity tier, with the legal or business reason for each. Check that the minimum does not conflict with a maximum imposed by privacy law or a contract. An assessor will compare retention settings in storage systems, backup jobs and mailboxes against the written schedule, so the schedule must name the systems it governs.
Disposal proportionate to sensitivity
Safeguard 3.5 asks for data to be securely disposed of as the documented process sets out, with both the process and the method matched to how sensitive the data is. Low-sensitivity files may need only deletion with logged removal, while sensitive records may need cryptographic erasure or physical destruction of media. Define the method for each tier and record who approved each disposal. Evidence is usually a disposal log, a destruction certificate from the vendor or a ticket that links the deletion to a retention rule.
Encryption on end-user devices
Safeguard 3.6 requires data on end-user devices that contain sensitive data to be encrypted. CIS cites Windows BitLocker, Apple FileVault and Linux dm-crypt as example implementations. The policy should name which device classes are in scope, who may hold recovery keys and how a device that fails to report encryption status is handled. Confirm the setting with a management console report rather than an installer checkbox, because an assessor will want proof that the setting is active across the fleet.
Testing the rules against evidence
Each rule in the policy should map to a record an assessor can sample: retention configurations, disposal logs, device encryption reports and exception approvals. The assessment specification scores the documented process for completeness, so a rule without a named owner or a measurable setting is a gap. Run a sample of each record type at least once a year, which is the review cadence the Safeguard 3.1 process requires, and keep the results with the policy. Expect exceptions, and document how each one is approved and closed.
How Control 3 grows from IG1 to IG3
Implementation Group 1 is CIS's essential cyber hygiene baseline and the minimum standard CIS sets for every enterprise. Six of the 14 Control 3 Safeguards apply at IG1, and the CIS data management policy template is written to support those six. It is the right starting point for a small or early-stage organization, but it is only a starting point for data protection.
- Written data management process (3.1): A documented process covering data sensitivity, ownership, handling, retention and disposal, reviewed yearly or after significant changes.
- Retention and disposal (3.4 and 3.5): Retention rules with both minimum and maximum timelines, and secure disposal matched to sensitivity.
- Encryption on end-user devices (3.6): Sensitive data on laptops and other end-user devices must be encrypted.
- Remaining IG1 items: The other IG1 Safeguards in Control 3 cover the data that the process must reach, so the policy and its inventory need to be built together.
- Scoring baseline: The assessment specification fails Safeguard 3.1 outright when no process exists, so the IG1 policy is the first thing an assessor checks.
Before relying on the template, confirm which of the six IG1 Safeguards your environment already meets and which need written procedures.
Six more Control 3 Safeguards are added at IG2, bringing the total for IG1 and IG2 to twelve. IG2 applies to enterprises with more operational complexity that often hold sensitive information. At this level, the data program moves from a policy on paper to a set of controls that track where data lives and who can reach it.
- Operational breadth: IG2 Safeguards expect data to be inventoried and classified across more systems, not only the devices a small team manages directly.
- Access and flows: Access control lists and documented data flows become necessary once several business units and third parties touch the same data.
- Loss prevention and logging: Data loss prevention and logging of sensitive data access are expected controls at this level.
- Policy gap: The IG1 template does not address these Safeguards, so the written material for them has to be developed separately.
- Ownership: Data owners named in the process need defined responsibilities for the IG2 controls they operate.
Ask your team to map each IG2 Safeguard to an existing control, a planned control, or a gap before you sign off on the scope of the program.
Two Control 3 Safeguards apply only at IG3, which CIS describes as the group for enterprises with security specialists and regulated, sensitive assets facing sophisticated, targeted attacks. With all 14 Safeguards, Control 3 covers the full range of the data protection program, from the IG1 baseline to the IG3 controls that apply to the most sensitive assets.
- Specialist ownership: IG3 assumes a dedicated security function that can run and monitor data controls, not only write policy for them.
- Targeted threat model: The IG3 Safeguards are aimed at sophisticated, targeted attacks against regulated and sensitive assets.
- Additional written material: Organizations in this group need procedures beyond the IG1 template, because the template does not address IG3 Safeguards.
- Assessment depth: Expect assessors to test the IG3 items against the assessment specification, which measures what to check but not how to check it.
- Scope decision: Whether IG3 applies depends on your sensitive data and regulatory context, so confirm the implementation group with your security leadership.
Confirm the exact text of the two IG3 Safeguards in the CIS Controls v8.1 documentation before you draft any procedure for them.
The CIS policy templates are built for IG1 and cater exclusively to IG1 Safeguards. CIS does not address IG2 or IG3 in them. An organization with sensitive data at higher implementation groups therefore needs written material beyond the template, and that material is the part auditors and customers tend to examine most closely.
- Template limits: Treat the IG1 data management template as the foundation, not the finished policy.
- Additional standards: Write procedures for IG2 and IG3 Safeguards that name owners, frequencies and evidence.
- Consistency: Keep the IG2 and IG3 material aligned with the five elements the assessment specification checks in the base process.
- Review cycle: Apply the annual review and the change-triggered review to all written material, not only the template.
- Evidence: Record approvals and review dates so an independent assessor can trace each rule to an owner.
When you ask a consultant or auditor for help, request a written list of which documents they will produce and which the organization must own.
How to build and approve a CIS-aligned data management policy
This sequence turns Safeguard 3.1 from a general intention into an approved, published policy that names what data is sensitive, who answers for it, how it is handled, kept and disposed of, and how devices holding it are encrypted. Each step produces a document or record that an assessor can read against the five completeness elements.
Confirm the sensitivity classes
Start by agreeing the classes of data the enterprise holds, from public material through to the most sensitive categories such as regulated personal, financial or health records and trade secrets. Keep the list short enough that staff can apply it without guessing. The output is a classification table with one row per class and a plain-language definition for each, approved by the people who own the enterprise's risk decisions. You know it is done when every data set in your data inventory maps to exactly one class.
Name data owners for each class
Assign an accountable owner to each sensitivity class, usually a business leader who understands the data's purpose and can approve access and retention decisions, with a technical custodian who runs the systems that hold it. Record both roles in the classification table so that questions about a data set have a named answer. The output is an owner register that lists each class, its owner, its custodian and the review contact. The step is complete when no class lacks an owner and the owners have confirmed they accept the role in writing.
Document handling rules for each class
For each class, write the handling guidance that governs storage, sharing, transmission, printing, copying to removable media and use in non-production environments. Keep each rule tied to the class rather than to individual systems, so the document still applies when tools change. The output is a handling matrix that staff and system owners can check against. You know this step is finished when a reviewer can take a common scenario, such as sending a dataset to an external party, and find a single rule that answers it.
Set retention limits by sensitivity
Define the minimum and maximum period each class may be kept, with the legal, contractual or business basis for each figure. Safeguard 3.4 asks for both bounds, so a rule that only says how long to keep data is incomplete. Confirm the periods with legal and records owners, because the applicable obligations depend on the enterprise's jurisdiction and sector. The output is a retention schedule, cross-referenced to the classification table. The step is complete when each class has both a minimum and a maximum, and any exception path is documented.
Define disposal methods proportionate to sensitivity
Specify how data is destroyed at the end of its retention period, with more rigorous methods for more sensitive classes. Examples include secure deletion for ordinary files, cryptographic erasure for encrypted stores, and physical destruction for retired media holding the most sensitive data. Safeguard 3.5 requires the method to match sensitivity, so record the method and the evidence it produces, such as a certificate of destruction or a deletion log. The output is a disposal standard table. The step is complete when every class has a method and each method names the record that proves it was carried out.
Set encryption requirements for end-user devices
Write the requirement that data on end-user devices holding sensitive data must be encrypted, as Safeguard 3.6 expects. Name the approved mechanisms for each platform in your estate, such as BitLocker on Windows, FileVault on macOS or dm-crypt on Linux, and state how keys are escrowed and who may recover them. Confirm with the platform team that the tooling you name can be enforced and reported centrally. The output is an encryption standard listing platforms, approved mechanisms and the status report that shows coverage. The step is complete when the standard maps every end-user platform in use to a mechanism.
Approve and publish the policy
Assemble the sensitivity classes, owner register, handling matrix, retention schedule, disposal standard and encryption standard into one data management policy, then route it for approval to the executive or board committee that owns information security. Record the approver, the approval date and the version number in the document control block. Publish it where staff can find it and notify the owners and custodians of their responsibilities. The output is an approved, versioned policy with an acknowledgement record. The step is complete when the approval and distribution records exist and the policy is available to everyone it applies to.
Schedule the annual review
Set a recurring review of the policy at least once a year, and trigger an earlier review after significant changes to the enterprise, such as a merger, a new regulated product or a move to a new cloud platform. Safeguard 3.1 expects this cadence. At each review, check the classes, owners, retention periods and encryption coverage against the current data inventory and record any changes in the version history. The output is a review calendar entry with an owner and a dated review record for each cycle. Confirm with your assessor which evidence of past reviews they will ask to see before the first formal assessment.
Who owns the policy, who writes it and who checks it
The organization owns its data management policy and every control it describes. That ownership cannot be handed to a consultant or a platform vendor, because Safeguard 3.1 only holds if the enterprise has actually defined its data, its sensitivity levels and its retention limits. An implementation partner such as DeployOpen can help prepare the written process, configure the systems that enforce it and assemble the evidence, but DeployOpen does not write the decisions on the organization's behalf and does not issue audit reports or certificates. Only an independent auditor, assessor or certification body tests the controls and reports on them.
Internal staff must make several decisions before anyone drafts text. Leadership or the data governance function should agree the sensitivity standard, meaning the labels used for data and what each label implies for handling. Each data set then needs a named data owner, a person accountable for its classification, access decisions and retention. The organization also has to set minimum and maximum retention periods by sensitivity, and state the disposal method each label requires. Legal, privacy and records management staff usually need to confirm retention periods against their own statutory and contractual obligations, since the CIS Controls do not set those periods for you.
Plan for the checking stage early. An assessor will look for a documented process that names the five elements the assessment specification scores, and for evidence that the process operates, such as data owner assignments, disposal records and encryption status on end-user devices. Ask your auditor which evidence formats they accept and whether they expect the policy to be reviewed yearly or after significant enterprise changes, as Safeguard 3.1 describes. Confirm the scope of the assessment in writing before engaging anyone, including whether a CIS-aligned review is an internal exercise or part of a formal attestation, because those two outcomes are handled differently by different parties.
What evidence shows the data management process is complete
The assessment specification checks whether a documented process exists and whether it covers five elements: data sensitivity, data owners, handling guidance, retention by sensitivity and disposal by sensitivity. Each card below is a record an assessor can sample to confirm those elements are present and in use, not just written down.
Approved policy with version history
The data management process itself, approved by a named executive, with a version number, an effective date and a review date. Safeguard 3.1 expects a review once a year or after significant enterprise changes, so the review record matters as much as the text. Check that the document names the five elements and that the approval predates the period under test. Ask your assessor whether they want the signed PDF, a controlled wiki page with change history, or both.
Data sensitivity classification
A classification scheme with defined levels and a rule for assigning each data set to one. Retention limits and disposal methods are set by sensitivity, so an assessor will trace a sample of data sets back to their level. Confirm that every level in the scheme maps to a retention period and a disposal method. A scheme with labels but no linked rules will not show completeness.
Data owner register
A register listing each data set or system, its named owner, the owner's role and the date the assignment was last confirmed. The policy must say who owns sensitive data and what the owner decides, including access and retention. Check for owners who have left the organization, owners assigned to whole departments rather than people, and data sets with no owner at all. Those gaps are the usual findings.
Retention and disposal records
Retention schedules showing minimum and maximum periods by sensitivity level, plus logs or tickets proving deletion or destruction happened as the schedule requires. Safeguard 3.4 and 3.5 are tested against both the schedule and the actual disposal activity. Keep records of the disposal method used for each class of data, since the method must be proportionate to sensitivity. Ask the assessor whether they expect sample deletions, backup expiry evidence or both.
Encryption status reports for end-user devices
Exported status from the device management platform showing which endpoints hold sensitive data and whether full-disk encryption is enabled, such as BitLocker on Windows, FileVault on macOS or dm-crypt on Linux. Safeguard 3.6 is about devices that contain sensitive data, so the report should be filtered by that population. Check the report date, the device count against the asset inventory and the exceptions list with approvals. Confirm the report format with your assessor before the review period starts.
Questions about the CIS data management policy template
Can we use the CIS data management policy template as it is?
Use it as a starting draft, not as a finished policy. CIS publishes its policy templates to align with CIS Controls v8 and v8.1 and to cover IG1 Safeguards only. The template gives you the structure of a data management process, but the substance must reflect your own data sensitivity levels, data owners, retention periods and disposal methods. Your organization owns the policy, approves it through its governance process and must follow it in practice. An assessor will test whether the process runs as written, so a template copied without local decisions will score poorly on completeness.
Is the CIS data management policy template free, and what does the license allow?
CIS says the Controls are free for any organization to use to improve its own cybersecurity. The CIS Controls content is licensed under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0, which means internal use is covered by the free-use position, while commercial use requires CIS's prior approval. Read the license terms yourself before you reuse template text in a product, a paid service or client deliverables. If you are a consultant or service provider, confirm with CIS whether your intended use is commercial, because that changes what you may do with the content.
How often should a CIS-aligned data management policy be reviewed?
Safeguard 3.1 expects the data management process to be reviewed once a year, and also after significant enterprise changes such as a merger, a new regulated data set or a move to a new hosting model. Build the review into your governance calendar with a named owner, record the date and outcome, and keep the previous version so an assessor can see the change history. A policy that was reviewed last year but no longer matches where your sensitive data actually lives will not meet the intent of the Safeguard.
Is IG1 enough for data management under the CIS Controls?
IG1 is the essential cyber hygiene baseline for every enterprise, and it includes the core data management policy. The template addresses IG1 Safeguards only, so it does not cover the additional Control 3 Safeguards that CIS adds at IG2 and IG3, such as data inventories, access control lists, data flows, segmentation and data loss prevention. Control 3 has 14 Safeguards in total: 6 apply from IG1, 6 more at IG2 and 2 more at IG3. If you hold sensitive information or face regulatory obligations, plan for the higher Implementation Groups and check which of them your sector or contracts require.
How much effort does a CIS data management policy take, and what must we supply?
The effort is driven mainly by how well your data is already understood, not by writing the document. Your organization must supply the sensitivity classes, the named data owners, the handling rules for each class, the retention limits and the disposal requirements. Those decisions come from legal, compliance, records and business owners, so expect the largest share of time in workshops and sign-off. The one-time cost is the drafting and approval; the recurring cost is the annual review and the evidence of how the process runs. Ask any provider for a written scope that lists who supplies each input and how many review rounds are included.
Do we need an outside partner to build a CIS data management policy?
You do not need an outside partner to write the policy, since the template is free and your own staff can adapt it. Many organizations bring in help when the data landscape is complicated, when the policy must be tied to technical controls such as encryption, backup and disposal, or when they want an independent check before an assessment. DeployOpen prepares systems, controls and evidence for compliance assessments under a fixed scope agreed in writing, but it does not issue audit reports or certifications. Any formal attestation or certification comes from an independent auditor or certification body, so confirm early which party will assess your evidence.
Where data management policies usually fall short
The most common weakness in a data management policy is that it reads well but cannot be tested. Four gaps recur: no named data owners, retention rules with no maximum, disposal written without a method and encryption that is promised for laptops but never checked. Each one maps to a specific element the Control 3 assessment looks for. The assessment specification scores Safeguard 3.1 by checking five elements (data sensitivity, data owners, handling guidance, retention limits by sensitivity and disposal requirements by sensitivity), so a policy missing an owner or a maximum period loses completeness on the same test that an assessor runs.
The fix for the first two gaps starts with a classification standard. Define a small set of sensitivity levels, then state for each level who owns the data, how it may be handled, its minimum and maximum retention and the disposal method required. Name the owner by role (for example, the head of finance for payment records) rather than by a team alias, and record who approves changes to the standard. A maximum retention period matters as much as a minimum because Safeguard 3.4 expects retention to be enforced at both ends. Ask the owner to confirm the maximum for each level against any legal or contractual retention rule that applies to your sector, since the policy cannot set those obligations for you.
Disposal and encryption gaps close when each requirement has an evidence owner. For disposal, Safeguard 3.5 requires the method to be proportionate to sensitivity, so the policy should name methods per level, such as overwriting, cryptographic erase or physical destruction, and the team that records each disposal. For Safeguard 3.6, the policy should require encryption on end-user devices holding sensitive data and assign a named role to export the device report monthly. Check it yourself: sample a set of laptops and confirm that BitLocker, FileVault or dm-crypt is active, then keep the export as evidence. An assessor will ask for that record, not for the sentence in the policy.
How DeployOpen prepares Control 3 evidence
DeployOpen works on the CIS data management policy template for Control 3 as an implementation partner. The organization owns its data management process and sign-off, while DeployOpen prepares the systems, controls and evidence that a CIS Controls assessment would test. Engagements are fixed-scope, with the scope and deliverables agreed in writing before work starts.
How we scope
- Agree in writing which Control 3 Safeguards are in scope, starting with the IG1 Safeguards 3.1 and 3.4 to 3.6.
- Confirm which data sets, owners and systems fall under the written data management process and its sensitivity levels.
- Record the retention and disposal rules the organization already applies, so the policy reflects current practice.
How we build
- Prepare the data management process draft with the five elements the assessment specification checks for Safeguard 3.1.
- Configure encryption on in-scope end-user devices using the native tools for each platform, such as BitLocker, FileVault or dm-crypt.
- Set up retention and disposal procedures in the systems that hold the data, so the documented rules match system behavior.
How we hand over
- Deliver the written policy, the supporting procedures and a record of each control check against the assessment specification.
- Provide evidence packs that show the encryption state, retention settings and disposal logs for the organization and its assessor to review.
- Document the annual review schedule and the triggers for review after significant enterprise changes, with the owner named for each.
How we support
- Offer ongoing support and periodic reviews of the data management process as a retainer, where the organization wants it.
- Update the policy and evidence when systems, data classes or retention rules change, and when the annual review falls due.
- Ask an independent assessor or auditor to test the controls, since DeployOpen prepares evidence but does not issue reports or certificates.
Sources and further reading
- CIS Controls Policy Templates ↗
- CIS Controls Assessment Specification for Controls v8.1: Safeguard 3.1 ↗
- CIS Controls Assessment Specification for Controls v8.1: Safeguard 3.4 ↗
- CIS Controls Assessment Specification for Controls v8.1: Safeguard 3.5 ↗
- CIS Control 3: Data Protection ↗
- CIS Critical Security Controls Navigator (v8.1) ↗
