Crossfoot
Crossfoot / Controls / Data classification and handling
Draft v0.1.06 of 6 frameworks

Data classification and handling

Data is identified, classified and handled according to sensitivity, including confidential information.

Where it appears

SOC 2
C1.1Identifies and maintains confidential information
PCI DSS 4.0
12.5.2PCI DSS scope is documented and confirmed (includes identifying all data flows)
NIST CSF 2.0
ID.AM-07Inventories of data and corresponding metadata are maintained
PR.DSData security
ISO 27001:2022
A.5.12Classification of information
A.5.13Labelling of information
HIPAA Security Rule
164.308(a)(1)(ii)(A)Risk analysis (requires identifying where ePHI lives)
NIST 800-53 r5
RA-2Security categorization

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Data classification policy and handling matrix
  • Data inventory or data-flow map showing where sensitive data is stored and transmitted
  • Evidence of labeling or tagging for classified data

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0