ISO 27001 Annex A 8.11 Data masking for sensitive information
What it says
Data masking shall be used in accordance with the organization's topic-specific policy on access control and other related topic-specific policies, and business requirements, taking applicable legislation into consideration.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse data masking to hide sensitive info based on policy requirements and legal obligations.
Data masking is a technique to hide sensitive information, like personal details, from those who shouldn't see it. It's important because if sensitive data like credit card numbers or private health details are exposed, they can lead to financial fraud or privacy breaches.
Free. Save your status, tasks and notes.
Why it matters
Without data masking, PII and other sensitive data may be exposed in logs, reports, and test environments, causing privacy breaches and legal non-compliance.
How to implement
The IT manager should implement data masking by identifying which types of data are considered sensitive, such as personal identification numbers or financial information.
This involves collaborating with data owners to understand what data needs protection and using software tools that hide this data during processing or storage, in line with ISO 27002:2022 guidance.
The Policy Team should work with the IT department to develop and update data masking policies.
This includes defining criteria for when and how data masking is to be employed, considering requirements like the Privacy Act 1988 and other relevant regulations.
Data Protection Officers should regularly review and assess the data masking techniques being used to ensure they are effective.
They can achieve this by keeping up-to-date with best practices and consulting the latest standards, such as ISO 27002:2022.
HR should train employees on the importance of data masking and how to handle sensitive data securely.
This training should be part of the induction process and regularly refreshed, combining real-world examples with compliance obligations like those under the Australian Privacy Principles.
The Governance Board should oversee the compliance of data masking practices with legal and organisational standards.
They should regularly receive reports showing data usage and incidents to ensure that the implementation of data masking aligns with the declared policies and the organisation's risk management framework.
Keep it running
Review masking rules per dataset and use case (test, analytics, logging); validate formats remain usable while identifiers are obscured, and update for new fields and laws.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The data masking policy document.
Look at
The details on how data masking is defined, including the criteria for data selection and the methodologies applied. Good policy includes specific masking techniques aligned with both organisational needs and legislative obligations.
- Check 2 of 5What an auditor asks for
Look at
Attendance records and training content. Good training records show regular sessions with clear outcomes related to data protection and legal compliance.
- Check 3 of 5What an auditor asks for
Ask for
Examples of masked data outputs.
Look at
Whether the sensitive information is adequately concealed in various reports or databases. Good examples would show clearly that unauthorised users cannot discern the original data values.
- Check 4 of 5What an auditor asks for
Ask for
Data protection incident reports that include details on data handling breaches.
Look at
Any gaps identified in data handling processes, particularly related to data masking failures.
Good evidence
System would show fewer incidents and rapid response and resolution procedures.
- Check 5 of 5What an auditor asks for
Look at
Details on who accessed the data and any exceptions granted. Good logs provide clear, detailed histories of access events and demonstrate compliance with security policies.
Mappings
Closest match in ASD Information Security Manual: ISM-1268, Enforce need-to-know access in databases, which partially overlaps with this control.
ASD Information Security Manual: 1 mapping
This control partially overlaps ISM-1268.
Annex A 8.11 requires organisations to apply data masking for sensitive information in line with access control policy, business needs, and applicable legislation. ISM-1268 relates by requiring database-level need-to-know enforcement using mechanisms such as minimum privileges, database views/roles and explicitly includes data tokenisation (a form of masking) to limit exposure of sensitive database contents. The overlap is specifically around using masking/tokenisation to reduce sensitivity of data presented to users, but ISM-1268 is focused on database access enforcement whereas Annex A 8.11 is broader and can apply to masking across systems, outputs, and contexts beyond databases.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.