Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1
DSP - Data Security & Privacy Lifecycle Management

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-DSP-17: Sensitive Data Protection

Apply protective measures to sensitive data at every stage of its lifecycle, from creation through to destruction.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 66 controls across 27 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 6 controls

FedRAMP High · 4 controls

  • AC-3 Access Enforcement
  • MP-2 Media Access
  • MP-4 Media Storage
  • SC-28 Protection of Information at Rest

FedRAMP Moderate · 4 controls

  • AC-3 Access Enforcement
  • MP-2 Media Access
  • MP-4 Media Storage
  • SC-28 Protection of Information at Rest

NIST SP 800-161 Rev 1 · 4 controls

PCI DSS 4.0 · 4 controls

  • 1.4.4 1.4.4 Cardholder data stores not reachable from untrusted networks
  • 12.10.7 12.10.7 Response procedures for PAN found in unexpected locations
  • 3.5.1 3.5.1 Stored PAN rendered unreadable
  • 3.4.1 3.4.1 PAN masked on display except for authorized roles

SOC 2 · 4 controls

  • SOC2-C1.1 C1.1 Identifying and maintaining confidential information
  • SOC2-P3.2 P3.2 Explicit consent before collecting information that requires it
  • SOC2-P5.1 P5.1 Data subject access
  • SOC2-PI1.5 PI1.5 Controls over stored inputs, work in process and outputs

APEC Cross-Border Privacy Rules (CBPR) System · 3 controls

APPI · 3 controls

  • APPI-A23 Security Control Measures
  • APPI-A41 Preparation and Handling of Pseudonymized Personal Information
  • APPI-A46 Security and Proper Handling of Anonymized Personal Information

C5 (Germany) · 3 controls

  • C5-CRY-03 Encryption of sensitive data for storage
  • C5-IDM-07 Access to cloud customer data
  • C5-INQ-04 Limiting Access to or Disclosure of Data in Investigation Requests

CIS Controls v8 · 3 controls

  • CIS-3.11 Encrypt Sensitive Data at Rest
  • CIS-3.12 Segment Data Processing and Storage Based on Sensitivity
  • CIS-3.3 Configure Data Access Control Lists

GDPR · 3 controls

  • GDPR-Art.32 Security of processing
  • GDPR-Art.5 Principles relating to processing of personal data
  • GDPR-Art.9 Processing of special categories of personal data

AWS Well-Architected Security Pillar · 2 controls

  • SEC07-BP02 Apply data protection controls based on data sensitivity
  • SEC08-BP04 Enforce access control

Australia Consumer Data Right - Banking (CDR) · 2 controls

  • AUCDR-IS-3 Securely manage information assets over their lifecycle
  • AUCDR-PS-12 Privacy Safeguard 12 - Security of CDR data and destruction or de-identification of redundant CDR data

Azure Security Benchmark · 2 controls

  • ASBv3-DP-1 Discover, classify, and label sensitive data
  • DP-2 Monitor anomalies and threats targeting sensitive data

CMMC 2.0 · 2 controls

HIPAA Security Rule · 2 controls

ISO 27001:2022 · 2 controls

  • 8.11 Data masking
  • 8.12 Data leakage prevention

ISO 27002:2022 · 2 controls

  • 8.11 Data masking
  • 8.12 Data leakage prevention

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
  • NIST-CSF-PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected

NIST SP 800-171 Rev 3 · 2 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-31 Encrypt Sensitive Data, in Particular on Equipment That May Be Lost

APRA CPS 234 · 1 control

  • CPS234-21 Implementation of Information Security Controls

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-27 Outbound data loss prevention (Very Good)

Australia My Health Records Act 2012 · 1 control

Australian Privacy Principles (APPs) · 1 control

  • APP-11 APP 11 - Security of personal information

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-37 Protection of Swap Data Repository Data

NIST SP 800-66 Rev 2 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in DSP - Data Security & Privacy Lifecycle Management

You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done?

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-DSP-17 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.

If you hold NIST SP 800-53 Rev 571.1% covered · 57 gapsIf you hold FedRAMP Moderate60.4% covered · 78 gapsIf you hold PCI DSS 4.060.4% covered · 78 gapsIf you hold C5 (Germany)58.4% covered · 82 gapsIf you hold ISO 27001:202256.3% covered · 86 gapsIf you hold ISO 27002:202256.3% covered · 86 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 66 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls