Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Documentation of data sets for data stores

Critical
High
Normal
Low

The organization shall maintain a list of data sets contained in the data stores it manages.

The documentation shall include at least the following information:

  • Data systems and other means used to process the data sets
  • Key categories of data in the data set (and whether it contains personal data)
  • Data retention period (discussed in more detail in a separate task)
  • Information on archiving / disposal of data (discussed in more detail in a separate task)
Connected other frameworks and requirements:
T07: Tietojen luokittelu
4 luku, 13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
4 luku, 15 §: Tietoaineistojen turvallisuuden varmistaminen
6. Lawfulness of processing
GDPR
5. Principles relating to processing of personal data
GDPR

Documentation of other protected assets

Critical
High
Normal
Low

The organization shall list all relevant protected assets to determine ownership and to ensure that security measures cover all necessary items.

A large portion of the protected assets (including data sets, data systems, personnel / units, and partners) are treated through other tasks. In addition, the organization must list other important assets, which may be, depending on the nature of its operations, e.g. hardware (servers, network equipment, workstations, printers) or infrastructure (real estate, power generation, air conditioning). In addition the organization should make sure that relevant external devices are documented.

Connected other frameworks and requirements:
8.1.1: Inventory of assets
ISO 27001
8.1.2: Ownership of assets
ISO 27001
ID.AM-1: Physical device inventory
NIST CSF
ID.AM-2: Software and app inventory
NIST CSF
5.9: Inventory of information and other associated assets
ISO 27001

Documentation of assets inventories outside the ISMS

Critical
High
Normal
Low

Assets to be protected related to information and data processing services should be inventoried. The purpose is to ensure that the cyber security is focused on the necessary information assets.

Inventory can be done directly in the management system, but an organization may have other, well-functioning inventory locations for certain assets (including code repositories, databases, network devices, mobile devices, workstations, servers, or other physical assets).

Describe in this task, which lists outside the management system are related to protection of information assets.

Connected other frameworks and requirements:
8.1.1: Inventory of assets
ISO 27001
ID.AM-1: Physical device inventory
NIST CSF
ID.AM-2: Software and app inventory
NIST CSF
5.9: Inventory of information and other associated assets
ISO 27001
No items found.