C1.1
C1.1
The entity identifies and maintains confidential information to meet the entity’s objectives related to confidentiality.
Category
Confidentiality
Subcategory
Additional Criteria for Confidentiality
Points of Focus
Defines and Identifies Confidential information
Procedures are in place to define, identify and designate confidential information when it is received or created.
Retains Confidential Information
Confidential information is retained for no longer than necessary to fulfill the identified purpose, unless a law or regulation specifically requires otherwise.
Protects Confidential Information from Destruction
Policies and procedures are in place to protect confidential information from erasure or destruction during the specified retention period of the information.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Cryptographic Protections | Cryptographic Protections | Documented evidence of organization-approved cryptographic solutions and modules for both data at rest and in transit. |
| Data Protection | Data Classification Scheme | Documented evidence of an organization-specific data classification scheme. |
| Data Protection | Data Handling Practices | Documented evidence of an organization-specific data handling practices (e.g., guidance specific the data classification scheme). |
| Identity & Access Management | Defined Roles & Authorizations (RBAC) | Documented evidence of defined access control-specific roles (e.g., Role Based Access Control (RBAC)) that affect both logical and physical access authorizations. |
Policies
- Data Management Policy - Establishes requirements for data classification, handling, and protection
- Privacy Policy - Defines requirements for protecting personal information and privacy