ASD ISM 0393 Classify databases based on data sensitivity
What it says
Databases and their contents are classified based on the sensitivity or classification of data that they contain.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDatabases should be classified according to how sensitive the data they contain is.
This control is about sorting your databases based on how sensitive the information they hold is. It's important because if sensitive data is kept in databases that aren't properly guarded, it could lead to leaks of confidential information, causing harm to privacy, and even resulting in financial losses or damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
If databases are misclassified, controls may be misapplied, enabling unauthorised access and disclosure of higher-sensitivity records.
How to implement
Management should determine the data sensitivity: Identify key data types held in databases, like personal customer information or financial details.
Classify these based on sensitivity using a simple high, medium, or low scale.
IT staff should label databases: Use the classifications to label each database accordingly.
Clearly mark databases and keep a record of the classifications.
Managers should ensure access controls match labels: Verify that employees can only access databases appropriate to their role.
Review access rights based on the database classification and adjust permissions as needed.
Create a data sensitivity policy: HR or compliance should write a policy document stating how data should be classified and handled.
This should be reviewed regularly and employees should be trained accordingly.
Schedule regular reviews: Set regular dates for reviewing the database classifications to ensure they stay up-to-date as the data or its usage evolves over time.
Keep it running
Maintain a documented database classification register and reclassify when schemas, data sources or sensitivity change; verify labels match the highest data classification stored.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The data classification policy document: Verify it outlines the criteria and process for classifying data sensitivity.
Look at
The date of issue and last review.
Good evidence
Document will be current and include clear guidelines.
- Check 2 of 4What an auditor asks for
Look at
Consistency and completeness. Good practice means no databases are unlabelled.
- Check 3 of 4What an auditor asks for
Ask for
How they apply access restrictions based on classification.
Good evidence
Includes specific procedures and recent updates.
- Check 4 of 4What an auditor asks for
Look at
Evidence of past reviews and a plan for future ones.
Good evidence
Plan includes regular timeframes and notes from past checks.
Mappings
Closest match in ISO/IEC 27001: A.5.12, Information classification policy and practices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.12.
Annex A 5.12 requires information to be classified according to the organisation's confidentiality, integrity and availability needs and relevant interested party requirements. ISM-0393 is a specific application of that requirement to databases, mandating that databases and their contents take a classification based on the sensitivity of the data they contain. Annex A 5.12 is broader because it covers all information types and the overarching policy/practices, not just database assets.
This control supports A.5.13.
ISM-0393 requires databases and their contents to be classified based on the sensitivity/classification of the data they contain. ISO/IEC 27001:2022 Annex A 5.13 focuses on labelling information in accordance with the classification scheme, which helps make database classification visible and actionable (e.g. database labels/metadata, schema tags, environment banners). Annex A 5.13 does not require determining the classification in the first place, so it supports rather than duplicates ISM-0393.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.