Frameworks / OWASP MASVS / OWASPMASVS-8 OWASP MASVS OWASPMASVS-8: MASVS-PRIVACY: Privacy and Data Protection Per OWASP MASVS v2 MASVS-PRIVACY: protect privacy + personal data in mobile apps. Requirements include (a) implement data minimisation collecting only data necessary for the function + (b) provide clear + accessible privacy notices + consent mechanisms + (c) implement data subject rights (access + rectification + erasure + portability) per applicable regulation + (d) implement secure handling of third-party SDK data sharing including privacy review + contractual controls + (e) maintain logging + monitoring for privacy-sensitive operations + (f) implement appropriate permission justifications + just-in-time prompts + (g) align to applicable privacy regulation (GDPR + CCPA + APPI + LGPD + similar) including breach notification + cross-border transfer controls.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 209 controls across 107 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-6.2 Scope, Context and Criteria ISO23894-A.5 Privacy and Data Protection in AI ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul ORANWG11-3 Cryptography, TLS, SSH, IPsec, and PKI Lifecycle Management ORANWG11-6 Security Test Specifications, Certification, and Conformance ORANWG11-7 Logging, Monitoring, Incident Response, and Denial-of-Service Resilience BSI-28 Audit event logging and storage BSI-29 Audit record review and analysis BSI-31 Audit log protection and retention IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-6.7 Service agreements ISO-19650-1-4 Information management concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-3-5.3 Trigger events for information exchange ISO-22320-5.1 General process requirements ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities ISO-25012-4.11 Traceability ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions 27011-1 Scope 27011-3 Terms and definitions 27011-8.4 Logging and monitoring 27557-1 Scope 27557-3 Terms and definitions 27557-6.2 Scope, context, and criteria for privacy 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration NISTSP82-6 OT Audit, Monitoring, Anomaly Detection, and OT-Specific SOC NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles NG-NDPA-5 Security of Processing, Breach Notification, and DPIA 58.1 Scope 58.3 Definitions AWWA-1.1 Security Policy and Governance AWWA-4.4 Audit Logging and Monitoring AL-DPA-1 Scope and Definitions AL-DPA-3 Lawful Basis for Processing AT-DSG-2 Section 2 - Scope and application AT-DSG-8 Section 22 - Functions and powers of the DPA DA-1 Enterprise Data Architecture DIQ-2 Data Quality Management FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup FDBR-702 Definitions (§501.702) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements 62351-14 Cyber security event logging 62351-2 Glossary of terms ISO-20400-4.2 Principles of sustainable procurement ISO-20400-7.2 Integrating sustainability into specifications ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-03 Continuous Improvement ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system 27014-1 Scope 27014-3 Terms and definitions ISO27043-04 Roles and responsibilities definition ISO27043-24 Logging and monitoring 29147-3 Terms and definitions 29147-9.2 Contact mechanisms and scope 30111-3 Terms and definitions 30111-5.1 Organizational policy ISO21434-04 Roles and responsibilities definition ISO21434-24 Logging and monitoring MTCS-Governance-ISMS-Risk-HR-Lifecycle-Compliance-Cloud-Strategy-Roles-Responsibilities MTCS Governance + ISMS + Risk Management + HR Security + Cloud Service Lifecycle + Compliance + Roles MTCS-Logging-Monitoring-Compliance-Audit-SLA-Configuration-SIEM-SOAR-Cloud-Monitoring-CSPM MTCS Logging + Monitoring + Compliance + Audit + SLA + Configuration + SIEM + SOAR + CSPM STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding NISTSP115-1 Scope, Methodology, and Assessment Planning NISTSP115-2 Review Techniques - Documentation, Logs, Rulesets, Configurations NISTSP123-5 Server Operations - Patching, Malware, Logging, Backup NISTSP123-8 Governance, Policies, and ISMS Integration NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment NISTSP137-4 Security Status Reporting and Risk Score Aggregation NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation NISTSP144-8 Monitoring, Incident Response, Exit Strategy, and Compliance NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework NISTSP146-6 Cloud Security and Privacy Recommendations NISTSP61-2 Computer Security Incident Response Team (CSIRT) Structure and Staffing NISTSP61-4 Detection and Analysis: Sources, Triage, Categorisation, Prioritisation NISTSP63R4-1 Digital Identity Risk Management and IAL/AAL/FAL Assurance Level Selection NISTSP63R4-8 Operational Audit, Session Management, Recovery, and Cross-cutting Controls NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework NISTSP88-7 Verification, Audit, Training, and Environmental/Safety Controls NISTSP92-1 Log Management Programme, Policy, Roles, and Operational Runbooks NISTSP92-5 Log Analysis: Correlation, Baselining, Anomaly Detection, Alerting, Manual Review NRC7354-2 Critical Digital Asset (CDA) Identification, Scope, and Boundary NRC7354-4 Security Controls Implementation per NRC RG 5.71 Appendix B/C OSSFSC-1 Branch Protection, Code Review, and Repository Governance OSSFSC-7 Webhook Authentication, Contributors Diversity, Aggregate Score ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training C1 Organizational Boundary C3 Scope 1 and 2 Coverage ISMSP-SYS-03 Security Monitoring and Log Management ISMSP-SYS-04 Vulnerability Management CFR211-A-3 Section 211.3 - Definitions 4.4.1 Resources, Roles, Responsibility, and Authority AZ-DPA-2 Article 2 - Basic Concepts CPG-6.B Supply Chain Incident Reporting COBIT-BAI02 Managed requirements definition CAT-D3-2 Detective controls FFIEC-05 Roles and responsibilities definition CA-9 Internal System Connections CA-9 Internal System Connections Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct ICP-1 Objectives, Powers and Responsibilities of the Supervisor IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality ISO-14064-1-5.1 Organizational boundaries ISO-26262-3-5 Item definition ISO27799-05 Audit trail for ePHI access ISO28001-PI-01 Personnel Security Screening ISO27003-4.3 Determining the scope of the information security management system 27007-5.2 Audit Programme Objectives 27050-1.4 Terms and definitions 27400-3 Terms and definitions 29115-3 Terms and definitions 29134-3 Terms and definitions BIPA-SEC5-1 Biometric Identifier Definition MDS2-Audit-Logging-AUDT-Integrity-IGAU-Cybersecurity-Risk-CYBR-Monitoring MDS2 Audit Controls + AUDT + Integrity + IGAU + Cybersecurity Risk + CYBR + Continuous Monitoring NAIC-2 Information Security Program (ISP) - Section 4 NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication NDPA-1 Applicability, Scope, and Carve-Outs AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OSFIB13-1 Governance, Risk Management, and Three Lines of Defense OPENBANK-2 Strong Customer Authentication (SCA), Consent Lifecycle, and Customer UX 2.2.2 2.2.2 Vendor default accounts managed PSPF24-1 Security Culture, Governance, Risk Management EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29) SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1) IM8-RES.2 Disaster Recovery PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 FADP-5 Definitions (Article 5) TEFCAREC-1 Common Agreement Conformance and Onboarding 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern USMCADIGITAL-1 Cross-Border Data Flows and Localisation VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 209 it maps to, and the evidence behind each claim, over MCP and REST.