Table of contents
ISO 27001 Data Masking
ISO 27001 Annex A 8.11 Data Masking is an ISO 27001 control that requires an organisation to mask data based on business requirements, laws and regulations to protect sensitive data.
Data masking is used to reduce the exposure of sensitive information, including personally identifiable data, by masking it and presenting only the data that is required to perform the task at hand.
Purpose
ISO 27001 Annex A 8.11 is preventive control that ensure you limit the exposure of sensitive data including PII, and you comply with legal, statutory, regulatory and contractual requirements.
Definition
The ISO 27001 standard defines ISO 27001 Annex A 8.11 as:
Data masking should be used in accordance with the organisation’s topic-specific policy on access control and other related topic-specific policies, and business requirements, taking applicable legislation into consideration.
ISO 27001:2022 Annex A 8.11 Data Masking
Why is data masking important?
Data masking is important because we want to limit the exposure of confidential and sensitive data. Showing information to people that they do not need to perform the task introduces risk. It is not unheard of for people to take photographs of screens and screen shots to get access to confidential and sensitive information. This is especially true where the data has a significant financial value.
Watch the Tutorial
In the video ISO 27001 Data Masking Explained – ISO27001:2022 Annex A 8.11 I show you how to implement it and how to pass the audit.
Implementation Guide
You are going to have to ensure that you:
- Implement a topic specific policy for access control
- define the requirements for data masking based on information classification level
- implement controls based on the data masking requirements
- keep records
- Test the controls that you have to make sure they are working
There are several approaches to hiding data that include data masking, pseudonymisation and anonymisation.
Let us take a look at the techniques for data masking that you can implement.
Anonymisation
This technique fundamentally and irreversibly alters data in a way that it can no longer be directly or indirectly identified.
Pseudonymisation
This technique uses an alias in place of data. It replaces data with an alias. If you know the algorithm used to create the alias it is possible to recreate the data. When this technique is used, every effort is taken to protect the algorithm.
Data Masking Techniques
This technique seeks to conceal, hide or substitute data. Let us consider
- Encryption
- Substitution
- Hashing
- Varying numbers and dates
- Deleting characters
What are the 3 layers of threat intelligence?
The 3 layers of threat intelligence are:
Strategic Threat Intelligence
High level information about the threat landscape.
Tactical Threat Intelligence
Intelligence on tools, techniques and attack methodologies.
Operational Threat Intelligence
Intelligence on specific attacks and indicators.
How to comply
To comply with ISO 27001:2022 Annex A 8.11 you are going to implement the ‘how’ to the ‘what’ the control is expecting.
In short measure you are going to:
- Understand and record the legal, regulatory and contractual requirements you have for data
- Conduct a risk assessment
- Based on the legal, regulatory, contractual requirements and the risk assessment you will implement an
information classification scheme - Implement and communicate your topic specific policy on access control
- Document and implement your processes and technical implementations for data masking
- Check that the controls are working by conducting internal audits
How to pass an audit
To pass an audit of ISO 27001:2022 Annex A 8.11 Data Masking you are going to make sure that you have followed the steps above in how to comply.
You are going to do that by first conducting an internal audit, following the How to Conduct an ISO 27001 Internal Audit Guide.
What will an auditor check?
The audit is going to check a number of areas. Lets go through the main ones
1. That you have documentation
What this means is that you need to show that you have documented your legal, regulatory and contractual requirements
for data masking. Where data protection laws exist that you have documented what those laws are and what those
requirements are. That you have an information classification scheme and a topic specific policy for access control and
that you have documented your data masking techniques.
2. That you have masked data appropriately
They will look at systems to seek evidence of data masking. This could be as simple as looking at login screens to see what masking you are doing on the password entry. It could also look at your production systems for evidence that sensitive data is masked.
3. That you have conducted internal audits
The audit will want to see that you have tested the controls and evidenced that they are operating. This is usually in the form of the required internal audits. They will check the records and outputs of those internal audits.
Top 3 Mistakes People Make
In my experience, the top 3 mistakes people make for ISO 27001:2022 Annex A 8.11 Data Masking are
1. You use unmasked data where you should not
Examples of this would include having sensitive data in development and test environments. Those areas that you might not think about. Consider for example using sensitive data as filenames, or in email subject fields or in email body text. Checking in CRM systems and off the shelf systems to see that data masking is enabled and configured is a good step here.
2. You don’t know your legal obligations
This is a massive mistake that we see, where people assume ISO 27001 is just information security and forget that it also checks that appropriate laws are being followed, and in particular data protection laws. Cost saving by not having a data protection expert or ignoring data protection law entirely is a common mistake we see people make when cutting corners and saving costs.
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
Data Masking FAQ
Is data masking a new ISO 27001:2022 control?
Yes data masking is a new ISO 27001:2022 control and a new requirement for ISO 27001:2022 certification
When was data masking added to ISO 27001?
Threat intelligence was added as an ISO 27001 control in 2022.
What clause of ISO 27001:2022 covers data masking?
ISO 27001:2022 Annex A 8.11 covers data masking.
What clause of ISO 27002:2022 covers data masking?
ISO 27002:2022 clause 8.11 covers data masking.
What is the difference between ISO 27001:2022 Annex A 8.11 and ISO 27002:2022 clause 8.11?
Nothing, they are the same thing. ISO 27002 is a standard in its own right and is included as an Annex to the ISO 27001 standard. As such it is often referred to as Annex A but it is a different name for the same thing.
How long will ISO 27001:2022 Annex A 8.11 data masking take me?
ISO 27001:2022 Annex A 8.11 will take approximately 1 day to setup if you are starting from nothing and doing it yourself. Then the process to implement data masking will take as long as it takes for you to make the technical and configuration changes required.
How much will ISO 27001:2022 Annex A 8.11 data masking cost me?
This depends on the complexity of your technical environment and the technologies that you are deploying. If bespoke alterations to code are required the cost can be significant. The costs that you will incur are
Time: the time to define and document the requirements, the time to implement the requirements
Money: the cost of technical tools and configuration changes to tools.
Related ISO 27001 Controls
ISO 27001 Threat Intelligence: Annex A 5.7
ISO 27001 Secure Systems Architecture and Engineering Principles: Annex A 8.27
Further Reading
How To Create an ISO 27001 Threat Intelligence Process and Report
