DAT-01Data and Privacy
Data inventory and classification
Data held is inventoried, classified and assigned an owner.
Why it exists
Everything downstream depends on knowing what you hold.
What usually proves it
Data map, classification scheme, owner assignment.
Smaller organizations
A single sheet listing systems, data types and owners.
Mapped to
- Fully addressedSOC 2 Trust Services Criteria · CC6.1
- Fully addressedISO/IEC 27001 Annex A · A.5.9
- Fully addressedNIST Cybersecurity Framework · ID.AM-07
- Fully addressedPCI DSS · 12.5.1
- Partially addressedHIPAA Security Rule · 164.310(d)(2) — Media and device accountability rather than a data map.
- Fully addressedGDPR · Art. 30
- Partially addressedEU AI Act · Art. 10 — Data governance applies to training and testing data.
- Fully addressedNIST AI Risk Management Framework · MAP 2.1