Content library
SOC 2 (Systems and Organization Controls)
PI1.1: Definitions of processed data

How to fill the requirement

SOC 2 (Systems and Organization Controls)

PI1.1: Definitions of processed data

Task name
Priority
Status
Theme
Policy
Other requirements
Definition of data classifications and class-specific security procedures
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Management of data sets
Data classification
requirements

Task is fulfilling also these other security requirements

T07: Tietojen luokittelu
Katakri
8.2.1: Classification of information
ISO27 Full
8.2.2: Labelling of information
ISO27 Full
8.2: Information classification
ISO27 Full
8.2.3: Handling of assets
ISO27 Full
1. Task description

Data classification can be used to give data processors a quick view of how critical data is and how data should be processed and protected.

The data categories used and the corresponding security levels are defined. The category of information is defined by analyzing the confidentiality, integrity and availability of the information in question, as well as any other requirements. Each level is given a clear and descriptive name.

Data classifications can be, for example, the following:

  • disclosure of information does not cause harm (PUBLIC)
  • disclosure of information causes slight inconvenience or minor operational annoyance (CONFIDENTIAL)
  • disclosure of information has significant short-term effects on operations or tactical objectives (LIMITED)
  • disclosure of information has serious implications for long-term strategic objectives or jeopardizes the very existence of the organization (PROHIBITED)

CONFIDENTIAL paper information may require e.g. the following protections:

  • Locked cabinet
  • Trusted transfer partner
  • Sealed envelopes
  • Safe disposal process

CONFIDENTIAL electronic information may require e.g. the following protections:

  • Use the selected encryption level
  • Password protection
  • Safe disposal process
  • More limited access rights
Documentation of data classes for data sets
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Management of data sets
Data classification
requirements

Task is fulfilling also these other security requirements

T07: Tietojen luokittelu
Katakri
8.2.1: Classification of information
ISO27 Full
18.1.3: Protection of records
ISO27 Full
ID.AM-5: Resource prioritization
NIST
HAL-04.2: Suojattavat kohteet - luokittelu
Julkri
1. Task description

The dataset owners (or the owners of the related information asset, such as a data store or data system) are responsible for the classifications of the datasets and the correspondence of the classification to the definitions of the classes.

The owner updates the data classification over the life cycle of the asset according to variations in its value, sensitivity, and criticality.

Defining the information needed to maintain the services or products offered
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Development and cloud
Cloud service management
requirements

Task is fulfilling also these other security requirements

PI1.1: Definitions of processed data
SOC 2
1. Task description

When data is delivered as part of a service or product or as part of a product or service-related reporting obligation, the definition of data must be available to data users.

The definition of data includes the following information:

  • The amount of events in the data
  • Type of information contained in each data element (e.g. field) (event to which the data field is related)
  • Sources of information
  • Data elements (e.g. fields) unit(s) of measurement
  • Precision of measurement
  • Uncertainty or confidence interval inherent in each data element
  • Date or time period of the event associated with the data
  • Variables (in addition to the date/period) that can be used to define the inclusion of items in data elements
Definitions and instructions on information classifications
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Management of data sets
Data classification
requirements

Task is fulfilling also these other security requirements

8.2.1: Classification of information
ISO27 Full
8.2.2: Labelling of information
ISO27 Full
12.1.1: Documented operating procedures
ISO27 Full
HAL-04.4: Suojattavat kohteet - merkitseminen
Julkri
5.13: Labelling of information
ISO27k1 Full
1. Task description

The ways in which information is classified and classifications marked are defined, markings are easily identifiable and they cover both physical and electronic information and assets. The marking must indicate to what extent the document is to be kept secret and on what basis the secrecy is based. Personnel are instructed on how to make markings.

No items found.