CIS Controls v8 CIS-3.1: Establish and Maintain a Data Management Process

What else in your programme already covers this

This control maps to 53 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27002:2022 · 5 controls

5.1 Policies for information security
5.10 Acceptable use of information and other associated assets
5.12 Classification of information
5.33 Protection of records
8.13 Information backup

ISO 27701:2019 · 5 controls

5.5.5 Documented information
6.10.2 Information transfer
6.5.2 Information classification
7.4.7 Retention
7.4.8 Disposal

ISO 27001:2022 · 4 controls

5.12 Classification of information
5.33 Protection of records
5.9 Inventory of information and other associated assets
8.10 Information deletion

PCI DSS 4.0 · 4 controls

12.1.2 12.1.2 Security policy reviewed annually and updated as needed
12.5.2 12.5.2 Annual and change-driven scope confirmation
3.2.1 3.2.1 Data retention and disposal minimise stored account data
3.3.1 3.3.1 SAD not retained after authorization, even encrypted

SOC 2 · 4 controls

SOC2-C1.1 C1.1 Identifying and maintaining confidential information
SOC2-C1.2 C1.2 Disposing of confidential information
SOC2-P4.2 P4.2 Retaining personal information
SOC2-P4.3 P4.3 Securely disposing of personal information

AWS Well-Architected Security Pillar · 3 controls

SEC07-BP01 Understand your data classification scheme
SEC07-BP02 Apply data protection controls based on data sensitivity
SEC07-BP04 Define scalable data lifecycle management

C5 (Germany) · 3 controls

C5-AM-02 Acceptable Use and Safe Handling of Assets Policy
C5-AM-06 Asset Classification and Labelling
C5-COS-08 Policies for data transmission

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

CCM-DSP-01 Security and Privacy Policy and Procedures
CCM-DSP-06 Data Ownership and Stewardship
CCM-DSP-16 Data Retention and Deletion

Australia My Health Records Act 2012 · 2 controls

MYHR-GOV-5 Retention, destruction and correction obligations of the System Operator
MYHR-SEC-1 Written security and access policy

DORA · 2 controls

DORA-Art.56 Data protection
DORA-Art.6 ICT risk management framework

FedRAMP High · 2 controls

MP-1 Policy and Procedures
SI-12 Information Management and Retention

FedRAMP Moderate · 2 controls

MP-1 Policy and Procedures
SI-12 Information Management and Retention

ISO/IEC 42001:2023 · 2 controls

7.5.3 Control of documented information
8.4 AI system impact assessment

NIST SP 800-171 Rev 3 · 2 controls

03.08.03 Media Sanitization
03.14.08 Information Management and Retention

APPI · 1 control

APPI-A17 Specification of the Purpose of Use

APRA CPS 234 · 1 control

CPS234-20 Information Asset Classification

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-3 Securely manage information assets over their lifecycle

Azure Security Benchmark · 1 control

ASBv3-GS-3 Define and implement data protection strategy

CMMC 2.0 · 1 control

MP.L2-3.8.1 Media Protection

HIPAA Security Rule · 1 control

164.310(d)(1) Device and Media Controls (Standard)

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-ID.AM-07 Inventories of data and corresponding metadata for designated data types are maintained

NIST SP 800-161 Rev 1 · 1 control

161R1-SI-12 Information Management and Retention

NIST SP 800-53 Rev 5 · 1 control

NIST800-SI-12 SI-12 Information Management and Retention

NIST SP 800-66 Rev 2 · 1 control

164.310(d)(1) Device and Media Controls (Standard)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of CIS Controls v8 have you already done?

CIS Controls v8 CIS-3.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CIS Controls v8 your existing evidence covers. Hold ISO 27001:2022 and 102 of 153 CIS Controls v8 controls already carry evidence.

If you hold ISO 27001:202266.7% covered · 51 gaps If you hold FedRAMP Moderate62.7% covered · 57 gaps If you hold NIST SP 800-53 Rev 557.5% covered · 65 gaps If you hold NIST Cybersecurity Framework 2.050.3% covered · 76 gaps If you hold ISO 27002:202249.7% covered · 77 gaps If you hold Azure Security Benchmark49% covered · 78 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 240 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free