ISO 27001 Data Masking: Annex A 8.11

Home / ISO 27001 Annex A Controls / ISO 27001 Data Masking: Annex A 8.11

ISO 27001 Data Masking

ISO 27001 Annex A 8.11 Data Masking is an ISO 27001 control that requires an organisation to mask data based on business requirements, laws and regulations to protect sensitive data.

Data masking is used to reduce the exposure of sensitive information, including personally identifiable data, by masking it and presenting only the data that is required to perform the task at hand.

Purpose

ISO 27001 Annex A 8.11 is preventive control that ensure you limit the exposure of sensitive data including PII, and you comply with legal, statutory, regulatory and contractual requirements.

Definition

The ISO 27001 standard defines ISO 27001 Annex A 8.11 as:

Data masking should be used in accordance with the organisation’s topic-specific policy on access control and other related topic-specific policies, and business requirements, taking applicable legislation into consideration.

ISO 27001:2022 Annex A 8.11 Data Masking

Why is data masking important?

Data masking is important because we want to limit the exposure of confidential and sensitive data. Showing information to people that they do not need to perform the task introduces risk. It is not unheard of for people to take photographs of screens and screen shots to get access to confidential and sensitive information. This is especially true where the data has a significant financial value.

Implementation Guide

You are going to have to ensure that you:

  • Implement a topic specific policy for access control
  • define the requirements for data masking based on information classification level
  • implement controls based on the data masking requirements
  • keep records
  • Test the controls that you have to make sure they are working

There are several approaches to hiding data that include data masking, pseudonymisation and anonymisation.
Let us take a look at the techniques for data masking that you can implement.

Anonymisation

This technique fundamentally and irreversibly alters data in a way that it can no longer be directly or indirectly identified.

Pseudonymisation

This technique uses an alias in place of data. It replaces data with an alias. If you know the algorithm used to create the alias it is possible to recreate the data. When this technique is used, every effort is taken to protect the algorithm.

Data Masking Techniques

This technique seeks to conceal, hide or substitute data. Let us consider

  • Encryption
  • Substitution
  • Hashing
  • Varying numbers and dates
  • Deleting characters

What are the 3 layers of threat intelligence?

The 3 layers of threat intelligence are:

Strategic Threat Intelligence

High level information about the threat landscape.

Tactical Threat Intelligence

Intelligence on tools, techniques and attack methodologies.

Operational Threat Intelligence

Intelligence on specific attacks and indicators.

Watch the Tutorial

In the video ISO 27001 Data Masking Explained – ISO27001:2022 Annex A 8.11 I show you how to implement it and how to pass the audit.

How to comply

To comply with ISO 27001:2022 Annex A 8.11 you are going to implement the ‘how’ to the ‘what’ the control is expecting.
In short measure you are going to:

  • Understand and record the legal, regulatory and contractual requirements you have for data
  • Conduct a risk assessment
  • Based on the legal, regulatory, contractual requirements and the risk assessment you will implement an
    information classification scheme
  • Implement and communicate your topic specific policy on access control
  • Document and implement your processes and technical implementations for data masking
  • Check that the controls are working by conducting internal audits

How to pass an audit

To pass an audit of ISO 27001:2022 Annex A 8.11 Data Masking you are going to make sure that you have followed the steps above in how to comply.
You are going to do that by first conducting an internal audit, following the How to Conduct an ISO 27001 Internal Audit Guide.

What will an auditor check?

The audit is going to check a number of areas. Lets go through the main ones

1. That you have documentation

What this means is that you need to show that you have documented your legal, regulatory and contractual requirements
for data masking. Where data protection laws exist that you have documented what those laws are and what those
requirements are. That you have an information classification scheme and a topic specific policy for access control and
that you have documented your data masking techniques.

2. That you have masked data appropriately

They will look at systems to seek evidence of data masking. This could be as simple as looking at login screens to see what masking you are doing on the password entry. It could also look at your production systems for evidence that sensitive data is masked.

3. That you have conducted internal audits

The audit will want to see that you have tested the controls and evidenced that they are operating. This is usually in the form of the required internal audits. They will check the records and outputs of those internal audits.

Top 3 Mistakes People Make

In my experience, the top 3 mistakes people make for ISO 27001:2022 Annex A 8.11 Data Masking are

1. You use unmasked data where you should not

Examples of this would include having sensitive data in development and test environments. Those areas that you might not think about. Consider for example using sensitive data as filenames, or in email subject fields or in email body text. Checking in CRM systems and off the shelf systems to see that data masking is enabled and configured is a good step here.

This is a massive mistake that we see, where people assume ISO 27001 is just information security and forget that it also checks that appropriate laws are being followed, and in particular data protection laws. Cost saving by not having a data protection expert or ignoring data protection law entirely is a common mistake we see people make when cutting corners and saving costs.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

Data Masking FAQ

Is data masking a new ISO 27001:2022 control?

Yes data masking is a new ISO 27001:2022 control and a new requirement for ISO 27001:2022 certification

When was data masking added to ISO 27001?

Threat intelligence was added as an ISO 27001 control in 2022.

What clause of ISO 27001:2022 covers data masking?

ISO 27001:2022 Annex A 8.11 covers data masking.

What clause of ISO 27002:2022 covers data masking?

ISO 27002:2022 clause 8.11 covers data masking.

What is the difference between ISO 27001:2022 Annex A 8.11 and ISO 27002:2022 clause 8.11?

Nothing, they are the same thing. ISO 27002 is a standard in its own right and is included as an Annex to the ISO 27001 standard. As such it is often referred to as Annex A but it is a different name for the same thing.

How long will ISO 27001:2022 Annex A 8.11 data masking take me?

ISO 27001:2022 Annex A 8.11 will take approximately 1 day to setup if you are starting from nothing and doing it yourself. Then the process to implement data masking will take as long as it takes for you to make the technical and configuration changes required.

How much will ISO 27001:2022 Annex A 8.11 data masking cost me?

This depends on the complexity of your technical environment and the technologies that you are deploying. If bespoke alterations to code are required the cost can be significant. The costs that you will incur are

Time: the time to define and document the requirements, the time to implement the requirements

Money: the cost of technical tools and configuration changes to tools

About the author

I am Stuart Barker the ISO 27001 Ninja.

You can connect with me on Linked In, stalk me, check me out and join my network.

I am an information security practitioner of over 30 years. I hold a Software Engineering degree and started my career in software development. In 2010 I started my first cyber security consulting business that I sold in 2018. I worked for over a decade for GE, leading a data governance team across Europe and since then have gone on to deliver hundreds of client engagements and audits.

I regularly mentor and train professionals on information security and run a successful ISO 27001 YouTube channel where I show people how they can do it themselves. I am passionate that knowledge should not be hoarded and brought to market the first of its kind online ISO 27001 store for all the tools and templates people need when they want to do it themselves.

In my personal life I am active and a hobbyist kickboxer.

My specialisms are ISO 27001 and SOC 2 and my niche is start up and early stage business.

Share to...