Document Data Flows
Description
Document data flows. Data flow documentation includes service provider data flows and should be based on the enterprise’s data management process. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
Implementation Checklist
Tool Recommendations
Data governance and compliance platform with DLP, information protection, sensitivity labels, and insider risk management
Microsoft · Per-user subscription (E5/standalone)
Cloud-native DLP and CASB platform providing inline data protection for SaaS, IaaS, web, and endpoint
Netskope · Per-user subscription
Enterprise data loss prevention covering endpoint, network, storage, and cloud channels with policy-based content inspection
Broadcom · Enterprise license
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Unmonitored Data Exfiltration Paths
ConfidentialityWithout documented data flows, attackers exploit unmonitored data pathways to exfiltrate sensitive data through third-party integrations or service provider connections.
Third-Party Data Exposure
ConfidentialityUndocumented data flows to service providers mean sensitive data is transmitted to third parties without appropriate contractual protections or security requirements.
Vulnerabilities (When Safeguard Absent)
Undocumented Data Flow Architecture
Without data flow documentation, the organization does not know how data moves between systems, users, and third parties, making it impossible to secure all pathways.
No Visibility into Service Provider Data Handling
Without documented data flows including third-party providers, the organization cannot verify that data shared with vendors receives appropriate protection.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Current inventory or catalog documentation | Maintained continuously, reviewed quarterly |
| Document | Process/procedure documentation for identification activities | Reviewed annually |
| Record | Third-party risk assessment reports and scorecards | Annually per vendor |
| Document | Vendor contracts with security requirements | Per contract cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |