ISO 27001A.8 — Data masking
A.8.11
Data masking
ISO 27001 · ISO/IEC 27001:2022 · Last verified August 2026
Objective
Use data masking techniques to limit exposure of sensitive information consistent with access control and privacy requirements.
Points of focus
- Identify fields needing masking
- Mask non-production datasets
- Mask in UI/logs where appropriate
- Control unmask privileges
Implementation notes
Build anonymized refresh pipelines for staging. Redact tokens and PII in centralized logging. Role-gate full PII views in admin tools with audit logs. Assign a named owner in the SoA, tie operating evidence to data masking standard, and sample the control during internal audit before Stage 2 fieldwork.
Audit tip: Show staging refresh job and a sample log without raw secrets; demonstrate who can unmask.
Evidence auditors typically request:
- Data masking standard
- Staging anonymization job config
- Log redaction rules
- Break-glass unmask tickets
Common gaps
- Prod DB clones in staging
- Plaintext PANs in logs
- Support tools showing full SSN by default
Cross-Framework Mapping
| Framework | Requirement | Implementation note |
|---|---|---|
| ISO 27001 | A.8.11 | This control |
| SOC 2 | CC6.1, CC6.7 | Related SOC 2 themes (CC6.1, CC6.7) — map in your crosswalk; not identical requirements. |
| GDPR | Article 25, Article 32 | Related GDPR themes (Article 25, Article 32) — map in your crosswalk; not identical requirements. |
| HIPAA | §164.514 | Related HIPAA themes (§164.514) — map in your crosswalk; not identical requirements. |
Primary sources
- ISO/IEC 27001:2022 Annex A: ISO/IEC 27001:2022 Annex A (A.8.11)
Frequently Asked Questions
No. Encryption protects confidentiality at rest/in transit; masking reduces exposure in use/display.
Article 32 and privacy-by-design often lead to masking/pseudonymisation — risk-based.
Tokenize or aggregate identifiers; limit raw PII exports.
Even without owned data centers, data masking still applies to how you operate endpoints, IdP, cloud consoles, and vendor services in scope. Exclude controls in the SoA only with a documented, risk-based rationale.
Start with data masking standard, assign a named control owner, and retain dated samples from your ticketing or GRC system — not one-off screenshots assembled before audit fieldwork.