A.8.11 Technological
Data masking
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (15)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- SC-28mostlyaligns with — Both controls protect sensitive data at rest by applying techniques that render the information unintelligible or unusable to unauthorized parties.
- SI-19mostlyaligns with — Both controls focus on de-identifying or anonymizing data to reduce privacy risk while preserving utility for authorized purposes.
- SI-19mostlycovers — A.8.11's data masking techniques (pseudonymization, redaction, etc.) account for the bulk of the de-identification and effectiveness-evaluation requirements in SI-19, but a residual of SI-19's formal dataset-level PII removal + re-identification risk assessment sits outside pure masking controls.
- AC-3partialaligns with — Both enforce the principle that users should only see the minimum data required for their role by restricting visibility of sensitive fields.
- AC-6partialaligns with — Both limit exposure of sensitive information by ensuring users receive only the data necessary for their authorized functions.
- MP-7partialaligns with — Both restrict how sensitive data may be used or viewed once it has been transformed or masked for protection.
- AC-3covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- AC-6covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- MP-7covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- SC-28covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
Aligned NIST CSF 2.0 outcomes (15)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.DS-01mostlyaligns with — The ISO control's masking, pseudonymization, and anonymization techniques directly support protecting the confidentiality of data-at-rest by obscuring sensitive values from unauthorized viewers.
- GV.OC-03partialaligns with — The ISO guidance explicitly requires consideration of legal, regulatory, and contractual obligations when applying masking or anonymization, matching the CSF outcome of addressing such requirements.
- PR.AA-05partialaligns with — The control's emphasis on role-based visibility, minimum-data queries, and selective obfuscation implements the outcome of defining, managing, and enforcing access permissions and entitlements.
- PR.DS-02partialaligns with — Masking and encryption methods described in the ISO control can be applied to data flows, thereby contributing to confidentiality and integrity protection for data-in-transit.
- PR.DS-10partialaligns with — Techniques such as encryption and substitution protect sensitive data while it is being processed or used, aligning with the CSF outcome for data-in-use protection.
- GV.OC-03implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.AA-05implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.DS-01implements — A.8.11 operationalizes data-at-rest confidentiality protection (a core part of PR.DS-01) by masking sensitive/PII data, which is one principal technical means within that domain but is not the only one named by the outcome.
- PR.DS-02implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.DS-10implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
Related OWASP ASVS 5.0 requirements (9)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V14.2.6mostlyaligns with — The ISO control's emphasis on showing only the minimum required data to each user directly supports the ASVS requirement that the application return only the minimum sensitive data needed for functionality.
- V14.2.3partialaligns with — By requiring that masked or anonymized data not be sent to untrusted parties, the ISO guidance aligns with the ASVS rule that sensitive data must not be disclosed to unauthorized external entities.
- V14.2.4partialaligns with — The ISO control's consideration of access controls, usage restrictions, and legal requirements for masked data corresponds to the ASVS requirement that sensitive data protection measures include access controls and logging rules.
- V14.2.8partialaligns with — The ISO control's requirement to mask or remove sensitive information from user-submitted files matches the ASVS requirement that metadata containing sensitive data be stripped unless the user consents to its retention.
- V14.3.3partialaligns with — The ISO control's focus on preventing unauthorized visibility of sensitive data aligns with the ASVS requirement that browser storage must not contain sensitive data without explicit protection.
Related weaknesses / CWE (22)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-1230mitigates — Data-masking techniques can obscure sensitive metadata values, providing partial mitigation.
- CWE-200prevents — By replacing or suppressing sensitive values before they reach unauthorized viewers, the control directly reduces the chance that an application will expose confidential data to actors who should not see it.
- CWE-201prevents — Data-masking techniques can prevent sensitive values from appearing in transmitted payloads.
- CWE-202prevents — Data masking prevents inference by obscuring sensitive values returned in query results.
- CWE-212prevents — Data-masking techniques can substitute for removal when full deletion is impractical.
- CWE-284mitigates — Role-specific and record-level masking implements an additional layer that enforces the principle of least privilege even when broader access-control checks have already passed.
- CWE-312mitigates — Substituting real values with hashes or encrypted tokens before storage reduces the quantity of cleartext sensitive information that ends up persisted on disk.
- CWE-313mitigates — Masking reduces exposure of sensitive values that might otherwise be stored in cleartext.
- CWE-317prevents — Data masking directly prevents cleartext display of sensitive GUI data.
- CWE-359prevents — Masking or anonymizing personal identifiers limits the amount of private personal information that can be disclosed through application outputs or logs.
- CWE-526mitigates — Data masking techniques can be applied to avoid storing sensitive values in cleartext environment variables.
- CWE-532mitigates — When log entries are produced from masked data sets, the control prevents the inadvertent insertion of sensitive values into externally accessible log files.
- CWE-538prevents — By ensuring that only the minimum necessary data is present in files or directories that may be reachable by external parties, the control lowers the impact of any subsequent exposure.
- CWE-549prevents — Data masking directly addresses hiding sensitive values such as passwords on user interfaces.
Mitigated MITRE ATT&CK techniques (197)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
T1001←MT1001.001←MT1001.002←MT1001.003←MT1005→PT1006←MT1014←MT1027←MT1027.001←MT1027.002←MT1027.003←MT1027.004←PT1027.006←MT1027.007←MT1027.008←MT1027.009←MT1027.010←MT1027.011←MT1027.012←MT1027.013←MT1027.014←MT1027.015←MT1027.016←MT1027.017←MT1027.018←MT1030←MT1036←MT1036.002←MT1036.003←MT1036.004←MT1036.005←MT1036.007←MT1036.008←MT1036.009←MT1036.011←MT1036.012←MT1040←M →PT1048←MT1048.003←MT1055←MT1055.001←MT1055.002←MT1055.003←MT1055.004←MT1055.005←MT1055.008←MT1055.009←MT1055.011←MT1055.012←MT1055.013←MT1055.014←MT1055.015←MT1070←MT1070.006←MT1071←MT1071.001←MT1071.002←MT1071.004←MT1078←PT1090.002←PT1090.003←MT1090.004←MT1095←MT1098.005←MT1102←MT1102.001←MT1102.002←MT1104←MT1114.001→PT1127←MT1127.001←MT1127.003←MT1132←PT1132.001←MT1132.002←MT1133←MT1134←MT1134.001←MT1134.002←MT1134.003←MT1134.004←MT1134.005←MT1140←MT1185←MT1202←MT1204.004←PT1205.001←PT1207←MT1211←PT1213→PT1213.004→PT1213.006→PT1216←MT1218←MT1218.001←PT1218.005←MT1218.007←MT1218.008←MT1218.010←MT1218.011←MT1218.012←MT1218.013←MT1219.003←MT1220←PT1221←MT1222←MT1222.001←PT1222.002←MT1480.001←MT1484←MT1484.002←MT1497←PT1497.002←MT1530←M →PT1535←MT1537←MT1539←MT1542←MT1542.002←MT1548.006←MT1550←MT1550.001←FT1550.002←FT1550.003←FT1550.004←FT1552→PT1552.001←M →PT1552.004→PT1553.001←FT1553.002←PT1553.003←MT1553.004←MT1553.005←MT1556←MT1556.001←MT1556.005←PT1556.007←MT1556.009←MT1560←MT1566.003←MT1568.003←PT1571←MT1572←MT1574←PT1574.001←MT1574.004←MT1574.013←MT1578←MT1578.001←MT1578.002←MT1578.003←MT1578.004←MT1578.005←PT1583.007←MT1587.001←PT1599←MT1599.001←PT1600←MT1600.001←PT1601.001←PT1601.002←MT1606←MT1606.001←MT1610←PT1611←PT1612←MT1620←MT1621←PT1647←PT1665←MT1666←MT1678←PT1685.002←MT1685.003←PT1685.004←MT1685.005←MT1686←FT1687←PT1688←MT1689←PT1690←M
Why these map — AI rationale (under review)
- T1005prevents — Data masking (including pseudonymization, anonymization, encryption, substitution, hashing, etc.) directly stops the adversary from obtaining usable sensitive data when they search and collect from local sources, but only for the subset of data to which masking is applied; the technique still succeeds against unmasked files, memory, or system artifacts.
- T1040prevents — A.8.11's masking techniques (encryption, hashing, substitution, nulling) applied to sensitive data in transit directly stop cleartext credentials/PII from being useful when sniffed, and its guidance on access/minimum data and legal requirements (e.g. card masking) constrains what is exposed; this is only a slice of T1040 because the technique also captures non-masked config details, works against already-encrypted sessions via TLS termination or MiTM, and succeeds on unmasked protocols or network-device captures outside the data-masking boundary.
- T1114.001prevents — A.8.11's data masking/pseudonymization/anonymization techniques (including encryption, substitution, hashing, and selective obfuscation) can prevent the collected .ost/.pst files from yielding usable sensitive email content when the adversary acquires them, but this is only a slice: it depends on the data having been masked beforehand, does not stop the collection action itself, and leaves unmasked email or non-email vectors untouched.
- T1213prevents — A.8.11's masking/pseudonymization/anonymization techniques (plus access/minimum-data rules) directly stop an adversary from extracting usable sensitive/PII values from repositories even after access is obtained, but leave non-sensitive repository contents (diagrams, policies, code snippets, credentials) and unmasked data untouched.
- T1213.004prevents — A.8.11's data masking, pseudonymization and anonymization techniques (plus access/minimum-data rules) can stop PII in CRM from being usable even after the adversary reaches the store, but only for data prepared under the control; it does not stop the adversary from reaching or mining the CRM itself.
- T1213.006prevents — A.8.11's masking/pseudonymization/anonymization techniques (plus access and usage restrictions) stop many classes of sensitive data (PII, financial) from being valuable or identifiable when mined, but do not stop the adversary from reaching or querying the database itself, nor do they cover non-sensitive data or all masking-strength scenarios.
- T1530prevents — A.8.11's masking/pseudonymization/anonymization techniques (plus access design and usage restrictions) stop the adversary from obtaining usable sensitive data even after a successful T1530 access, but only for data that the organization has chosen to mask; the control does not stop the access technique itself or apply to unmasked cloud objects.
- T1552prevents — Data masking (including encryption, substitution, hashing, nulling) directly stops plaintext credentials from being stored or exposed in searchable locations, preventing the technique from succeeding; it is only partial because the control is optional/consideration-based, does not mandate universal application to all credential stores, and leaves some forms (e.g., keys in memory or unmasked specialized artifacts) unreached.
- T1552.001prevents — A.8.11's data masking, pseudonymization, and anonymization techniques (plus access/minimum-data rules) can stop credentials from being exposed in files by hiding or removing them from viewable content, but this is only a slice: the control does not stop insecure credential storage outright, only selected masking cases, and leaves many file/backup/embedded credential scenarios untouched.
- T1552.004prevents — A.8.11's data masking, pseudonymization, anonymization, encryption, substitution, hashing and access-minimization techniques can prevent discovery/exposure of private keys stored on systems by rendering them unusable or invisible to unauthorized searchers, but this is only a slice of the technique (e.g. does not stop export via CLI, device-key extraction, passphrase brute-force or search in unmasked locations).
Prevented OWASP Web Top 10 (2025) risks (5)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A01mitigates — Data masking limits the visibility or usability of sensitive data that an attacker might reach via a broken access-control decision (e.g. IDOR, path traversal, or missing function-level checks), thereby bounding the consequence of the realized weakness without preventing or removing the authorization failure itself.
- A04mitigates — Data masking (including encryption, hashing, substitution) directly bounds the consequence of realized crypto failures by hiding sensitive data from unauthorized viewers even if it is weakly protected or exposed at rest/transit.
- A04prevents — A.8.11 directly mandates techniques (encryption, hashing, substitution, etc.) that stop sensitive data from being exposed in the clear, closing the 'absent or weak cryptography' slice of A04; it is only partial because A04 also covers misuse of cryptography (e.g. incorrect algorithm selection, improper key management, padding oracles) which this control does not address.
- A05mitigates — data masking (esp. substitution, hashing, nulling, varying values) bounds the consequence of an injection that succeeds and reaches an interpreter, by ensuring the exfiltrated or rendered result is not usable sensitive data; this is a classic mitigate, but only a slice of the 37-member category (e.g. helps XSS and some SQL exfil, does nothing for command injection, LDAP, or template injection that changes system state)
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.