To provide reliable management and assurance visibility into the status, effectiveness, risks, exceptions, and outcomes of data masking and anonymization.
Define reporting requirements, audience, metrics, frequency, evidence, and escalation. Reports should distinguish status, exceptions, risks, trends, and corrective actions.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.5 – Monitor, Evaluate and Assess (MEA) > MEA03 – Managed Compliance with External Requirements > MEA03.04 – Obtain assurance of external compliance. |
COBIT
Governance Framework
|
v2019 | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(2) – ICT security policies, procedures, protocols and tools for resilience and data security Article 9(3) – ICT solutions/processes for secure data transfer and prevention of loss, unauthorised access and data compromise |
EU
Regulation
|
vCurrent | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 25(1) – Data protection by design and by default; Article 32(1)(a) – Pseudonymisation and encryption |
EU
Regulation
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.1-3.3 – Data Classification Process |
India
Guideline
|
vLatest | View → |
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 7.4 – Communication |
ISO
Standard
|
v2022 | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 8.11 – Data masking |
ISO
Standard
|
v2022 | View → |
| ISO27701 | ISO/IEC 27701 ISO/IEC 27701 provides requirements and guidance f... Clause: A.7.4.5; A.7.4.5 – PII de-identification and deletion at end of processing |
ISO
Privacy Standard
|
v2019 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(1) – Cybersecurity risk-management measures – general obligation Article 21(2)(a) – Policies on risk analysis and information system security |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.AM – Asset Management | ID.AM-07 – Inventories of data and corresponding metadata for designated data types are maintained PR.DS – Data Security | PR.DS-01 – The confidentiality, integrity, and availability of data-at-rest are protected |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.19 – SYSTEM AND INFORMATION INTEGRITY; SI-19 – DE-IDENTIFICATION |
NIST
Control Catalog
|
vRev. 5 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Data Security – Masking |
India
Standard
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 1) Inventory Management of Business IT Assets – 1.2 Data/information classification by sensitivity; 15) Data Leak prevention strategy – 15.1 Comprehensive data loss/leakage prevention strategy for sensitive business/customer data |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 3.3 PR.DS: Data Security |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: C1.1 – Confidentiality – The entity identifies and maintains confidential information to meet the entity’s objectives related to confidentiality. CC6.7 – Logical and Physical Access Controls – The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity’s objectives. CC2.2 – Information and Communication – COSO Principle 14: The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control. |
AICPA
Audit Framework
|
vLatest | View → |