A.8.11 Technological
Data masking
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (10)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- SC-28mostlyaligns with — Both controls protect sensitive data at rest by applying techniques that render the information unintelligible or unusable to unauthorized parties.
- SI-19mostlyaligns with — Both controls focus on de-identifying or anonymizing data to reduce privacy risk while preserving utility for authorized purposes.
- AC-3partialaligns with — Both enforce the principle that users should only see the minimum data required for their role by restricting visibility of sensitive fields.
- AC-6partialaligns with — Both limit exposure of sensitive information by ensuring users receive only the data necessary for their authorized functions.
- MP-7partialaligns with — Both restrict how sensitive data may be used or viewed once it has been transformed or masked for protection.
Aligned NIST CSF 2.0 outcomes (9)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.DS-01mostlyaligns with — The ISO control's masking, pseudonymization, and anonymization techniques directly support protecting the confidentiality of data-at-rest by obscuring sensitive values from unauthorized viewers.
- GV.OC-03partialaligns with — The ISO guidance explicitly requires consideration of legal, regulatory, and contractual obligations when applying masking or anonymization, matching the CSF outcome of addressing such requirements.
- PR.AA-05partialaligns with — The control's emphasis on role-based visibility, minimum-data queries, and selective obfuscation implements the outcome of defining, managing, and enforcing access permissions and entitlements.
- PR.DS-02partialaligns with — Masking and encryption methods described in the ISO control can be applied to data flows, thereby contributing to confidentiality and integrity protection for data-in-transit.
- PR.DS-10partialaligns with — Techniques such as encryption and substitution protect sensitive data while it is being processed or used, aligning with the CSF outcome for data-in-use protection.
Related OWASP ASVS 5.0 requirements (9)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V14.2.6mostlyaligns with — The ISO control's emphasis on showing only the minimum required data to each user directly supports the ASVS requirement that the application return only the minimum sensitive data needed for functionality.
- V14.2.3partialaligns with — By requiring that masked or anonymized data not be sent to untrusted parties, the ISO guidance aligns with the ASVS rule that sensitive data must not be disclosed to unauthorized external entities.
- V14.2.4partialaligns with — The ISO control's consideration of access controls, usage restrictions, and legal requirements for masked data corresponds to the ASVS requirement that sensitive data protection measures include access controls and logging rules.
- V14.2.8partialaligns with — The ISO control's requirement to mask or remove sensitive information from user-submitted files matches the ASVS requirement that metadata containing sensitive data be stripped unless the user consents to its retention.
- V14.3.3partialaligns with — The ISO control's focus on preventing unauthorized visibility of sensitive data aligns with the ASVS requirement that browser storage must not contain sensitive data without explicit protection.
Related weaknesses / CWE (22)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-212fullprevents — Data-masking techniques can substitute for removal when full deletion is impractical.
- CWE-200mostlyprevents — By replacing or suppressing sensitive values before they reach unauthorized viewers, the control directly reduces the chance that an application will expose confidential data to actors who should not see it.
- CWE-201mostlyprevents — Data-masking techniques can prevent sensitive values from appearing in transmitted payloads.
- CWE-202mostlyprevents — Data masking prevents inference by obscuring sensitive values returned in query results.
- CWE-317mostlyprevents — Data masking directly prevents cleartext display of sensitive GUI data.
- CWE-359mostlyprevents — Masking or anonymizing personal identifiers limits the amount of private personal information that can be disclosed through application outputs or logs.
- CWE-538mostlyprevents — By ensuring that only the minimum necessary data is present in files or directories that may be reachable by external parties, the control lowers the impact of any subsequent exposure.
- CWE-549mostlyprevents — Data masking directly addresses hiding sensitive values such as passwords on user interfaces.
- CWE-1230partialmitigates — Data-masking techniques can obscure sensitive metadata values, providing partial mitigation.
- CWE-284partialmitigates — Role-specific and record-level masking implements an additional layer that enforces the principle of least privilege even when broader access-control checks have already passed.
- CWE-312partialmitigates — Substituting real values with hashes or encrypted tokens before storage reduces the quantity of cleartext sensitive information that ends up persisted on disk.
- CWE-313partialmitigates — Masking reduces exposure of sensitive values that might otherwise be stored in cleartext.
- CWE-526partialmitigates — Data masking techniques can be applied to avoid storing sensitive values in cleartext environment variables.
- CWE-532partialmitigates — When log entries are produced from masked data sets, the control prevents the inadvertent insertion of sensitive values into externally accessible log files.
Mitigated MITRE ATT&CK techniques (5)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1039partialmitigates — By obfuscating or removing PII and other sensitive values from network shares, the control lowers the usefulness of data an attacker can harvest from shared drives.
- T1213partialmitigates — Applying masking or pseudonymization to information repositories ensures that even if an adversary queries or exports repository contents, the exposed records contain far less usable sensitive data.
- T1530partialmitigates — Masking or anonymizing data stored in cloud object storage means that stolen cloud storage objects yield little or no directly usable PII or credentials.
- T1005nonemitigates — Masking or anonymizing sensitive fields on local systems reduces the value of data an adversary can collect from the host, limiting the impact of successful local file or memory reads.
- T1552nonemitigates — Replacing or hashing credentials and secrets in files, configuration stores, or other locations prevents an attacker from obtaining usable authentication material even if the files are later accessed.
Prevented OWASP Web Top 10 (2025) risks (3)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A04partialmitigates — Replacing plaintext values with hashes or encrypted tokens prevents exposure of sensitive data even if cryptographic protections around storage or transit are weak or absent.
- A01nonemitigates — Masking or anonymizing sensitive fields limits the data visible to any given user or process, thereby reducing the impact of overly permissive access rules or missing authorization checks.
- A07nonemitigates — By ensuring that only the minimum necessary data is shown, the control reduces the blast radius of authentication or session-management flaws that would otherwise grant broad data visibility.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.