To provide ongoing visibility into the effectiveness and compliance of data masking and anonymization, enabling timely detection, escalation, and correction of issues.
Test masking, anonymization, and pseudonymization transformations for correctness, re-identification resistance, consistency, and required data utility before release.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.1-3.3 – Data Classification Process |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 1) Inventory Management of Business IT Assets – 1.2 Data/information classification by sensitivity; 15) Data Leak prevention strategy – 15.1 Comprehensive data loss/leakage prevention strategy for sensitive business/customer data |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 3.3 PR.DS: Data Security |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(2) – ICT security policies, procedures, protocols and tools for resilience and data security Article 9(3) – ICT solutions/processes for secure data transfer and prevention of loss, unauthorised access and data compromise |
EU
Regulation
|
vCurrent | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 8.11 – Data masking |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(1) – Cybersecurity risk-management measures – general obligation Article 21(2)(a) – Policies on risk analysis and information system security |
EU
Directive
|
vCurrent | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 3.5.1 – PAN is rendered unreadable anywhere it is stored |
PCI
Standard
|
v4 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.AM – Asset Management | ID.AM-07 – Inventories of data and corresponding metadata for designated data types are maintained PR.DS – Data Security | PR.DS-01 – The confidentiality, integrity, and availability of data-at-rest are protected |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.19 – SYSTEM AND INFORMATION INTEGRITY; SI-19 – DE-IDENTIFICATION |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Data Security |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: C1.1 – Confidentiality – The entity identifies and maintains confidential information to meet the entity’s objectives related to confidentiality. CC6.7 – Logical and Physical Access Controls – The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity’s objectives. |
AICPA
Audit Framework
|
vLatest | View → |
| ISO27701 | ISO/IEC 27701 ISO/IEC 27701 provides requirements and guidance f... Clause: A.7.4.5; A.7.4.5 – PII de-identification and deletion at end of processing |
ISO
Privacy Standard
|
v2019 | View → |