Establish and Maintain a Data Inventory

Organisation must maintain a listing of used data systems and their owners. Owner is responsible for completing the related documentation and possible other security actions directly related to the data system.

Data system documentation must include at least:

• System purpose and linked responsibilities
• System's data location (covered in a separate task)
• System's maintenance and development responsibilities and linked partners (covered in a separate task)
• When necessary system's access roles and authentication methods (covered in a separate task)
• When necessary systems interfaces to other systems (covered in a separate task)

The dataset owners (or the owners of the related information asset, such as a data store or data system) are responsible for the classifications of the datasets and the correspondence of the classification to the definitions of the classes.

The owner updates the data classification over the life cycle of the asset according to variations in its value, sensitivity, and criticality.

Organisation must maintain a listing of controlled data stores and their owners. Owner is responsible for completing the documentation and other possible security actions directly related to the data store.

Data store documentation must include at least:

• Connected responsibilities
• Data processing purposes (covered in a separate task)
• Data sets included in the data store (covered in a separate task)
• Data disclosures (covered in a separate task)
• When necessary, data stores connections to action processes

The organization shall maintain a list of data sets contained in the data stores it manages.

The documentation shall include at least the following information:

• Data systems and other means used to process the data sets
• Key categories of data in the data set (and whether it contains personal data)
• Data retention period (discussed in more detail in a separate task)
• Information on archiving / disposal of data (discussed in more detail in a separate task)