ISO 27002:2022 – Control 8.11 – Data Masking

Purpose of Control 8.11

Data masking is a technique used to protect sensitive data – usually any data that could be deemed personally identifiable information (PII) – over and above an organisation’s standard information security protocols such as access control etc.

Data masking is often mentioned in legal, statutory and regulatory guidelines and laws governing the storage and access of employee, customer, user and vendor information.

Attributes Table of Control 8.11

Control 8.11 is a preventive control that modifies risk by suggesting a series of data masking techniques which safeguard PII, and helps the organisation to remain compliant with what’s asked of it by legal authorities and regulatory agencies.

Ownership of Control 8.11

Data masking is a complex technical process that involves altering sensitive information, and preventing users from identifying data subjects through a variety of measures.

Whilst this is itself an administrative task, the nature of data masking is directly related to an organisation’s ability to remain compliant with laws, regulations and statutory guidelines concerning the storage, access and processing of data. As such, ownership should reside with the Chief Information Security Officer, or organisational equivalent.

General Guidance on Compliance

Control 8.11 asks organisations to consider data masking through the scope of two main techniques – pseudonymisation and/or anonymisation. Both of these methods are designed to disguise the true purpose of PII through disassociation – i.e. hiding the link between the raw data, and the subject (usually a person).

Organisations should take great care to ensure that no single piece of data compromises the subject’s identity.

When using either of these techniques, organisations should consider:

1. The level of pseudonymisation and/or anonymisation required, relative to the nature of the data.
2. How the masked data is being accessed.
3. Any binding agreements that restrict use of the data to be masked.
4. Keeping the masked data separate from any other data types, in order to prevent the data subject being easily identified.
5. Logging when the data was received, and how it has been provided to any internal or external sources.

Guidance – Additional Techniques

Pseudonymisation and anonymisation aren’t the only methods available to organisations looking to mask PII or sensitive data. Control 8.11 outlines 5 other methods that can be used to bolster data security:

1. Key-based encryption.
2. Voiding or deleting characters within the dataset.
3. Varying numbers and dates.
4. Replacing values across the data.
5. Hash-based value masking.

Guidance – Data Masking Principles

Data masking is an important part of an organisation’s policy towards protecting PII and safeguarding the identity of the individuals whom it holds data on.

As well as the above techniques, organisations should consider the below suggestions when strategising their approach to data masking:

1. Implement masking techniques that only reveal the minimum amount of data to anyone who uses it.
2. ‘Obfuscating’ (hiding) certain pieces of data at the request of the subject, and only allowing certain members of staff to access the sections that are relevant to them.
3. Building their data masking operation around specific legal and regulatory guidelines.
4. Where pseudonymisation is implemented, the algorithm that is used to ‘de-mask’ the data is kept safe and secure.

Changes and Differences from ISO 27002:2013

None. Control 8.11 has no precedent in ISO 27002:2013 as it is new.

New ISO 27002 Controls

How ISMS.online Helps

Our cloud-based platform provides you with a robust framework of information security controls so that you can checklist your ISMS process as you go to ensure that it meets the requirements for ISO 27002:2022.

Get in touch today to book a demo.