CIS Controls v8

CIS 3 Data Protection

Starts in IG1 | Protect data with classification, handling, and lifecycle controls.

Implementation Actions

  • Classify sensitive data.
  • Apply encryption and access controls.
  • Enforce retention and disposal standards.

Evidence Examples

  • Data classification matrix
  • Encryption configuration
  • Retention/disposal records

Suggested Metrics

  • Sensitive data encryption coverage
  • Data handling violations