DAT-01 · Data and Privacy
Data inventory and classification
Data held is inventoried, classified and assigned an owner.
6frameworks fully address it
2partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC6.1
- ISO 27001FullA.5.9
- NIST CSFFullID.AM-07
- PCI DSSFull12.5.1
- HIPAAPartial164.310(d)(2) Media and device accountability rather than a data map.
- GDPRFullArt. 30
- EU AI ActPartialArt. 10 Data governance applies to training and testing data.
- NIST AI RMFFullMAP 2.1
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Data map, classification scheme, owner assignment.
?Why it exists
Everything downstream depends on knowing what you hold.
For a smaller organizationA single sheet listing systems, data types and owners.