DCH-01.4: Defining Access Authorizations for Sensitive / Regulated Data

There is no evidence of a capability to explicitly define authorizations for specific individuals and/or roles for logical and/or physical access to sensitive/regulated data.

C|P-CMM1 is N/A, since a structured process is required to explicitly define authorizations for specific individuals and/or roles for logical and/or physical access to sensitive/regulated data.

C|P-CMM2 is N/A, since a well-defined process is required to explicitly define authorizations for specific individuals and/or roles for logical and/or physical access to sensitive/regulated data.

Data Classification & Handling (DCH) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist: o Are expected to take the initiative to work with Data Protection Officers (DPOs) to ensure applicable statutory, regulatory and contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data. o Maintain decentralized inventory logs of all sensitive/regulated media and update sensitive/regulated media inventories at least annually. o Create and maintain Data Flow Diagrams (DFDs) and network diagrams. o Document where sensitive/regulated data is stored, transmitted and processed in order to document data repositories and data flows. o Identify data classification types to ensure adequate cybersecurity and data protection controls are in place to protect organizational information and individual data privacy. o Identify and document the location of information on which the information resides. o Restrict and govern the transfer of data to third-countries or international organizations. o Limit the disclosure of data to authorized parties. o Mark media in accordance with data protection requirements so that personnel are alerted to distribution limitations, handling caveats and applicable security requirements. o Prohibit “rogue instances” where unapproved third parties are engaged to store, process or transmit data, including budget reviews and firewall connection authorizations. o Protect and control digital and non-digital media during transport outside of controlled areas using appropriate security measures. o Govern the use of personal devices (e.g., Bring Your Own Device (BYOD)) as part of acceptable and unacceptable behaviors. o Dictate requirements for minimizing data collection to what is necessary for business purposes. o Dictate requirements for limiting the use of sensitive/regulated data in testing, training and research.

• A Governance, Risk & Compliance (GRC) function, or similar function, assists users in making information sharing decisions to ensure data is appropriately protected, regardless of where or how it is stored, processed and/ or transmitted.
• A data classification process exists to identify categories of data and specific protection requirements.
• A data retention process exists to protect archived data in accordance with applicable statutory, regulatory and contractual obligations.
• Data/process owners:
• A Data Protection Impact Assessment (DPIA) is used to help ensure the protection of sensitive/regulated data processed, stored or transmitted on internal or external systems, in order to implement cybersecurity and data protection controls in accordance with applicable statutory, regulatory and contractual obligations.
• Human Resources (HR), documents formal “rules of behavior” as an employment requirement that stipulates acceptable and unacceptable practices pertaining to sensitive/regulated data handling.
• Data Loss Prevention (DLP), or similar content filtering capabilities, blocks users from performing ad hoc file transfers through unapproved file transfer services (e.g., Box, Dropbox, Google Drive, etc.).
• Mobile Device Management (MDM) software is used to restrict and protect the data that resides on mobile devices.
• Administrative processes and technologies:

See C|P-CMM3. There are no defined C|P-CMM4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to explicitly define authorizations for specific individuals and/or roles for logical and/or physical access to sensitive/regulated data.

See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to explicitly define authorizations for specific individuals and/or roles for logical and/or physical access to sensitive/regulated data.