[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F3":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","3","Control 3","Data Protection",1542,"Center for Internet Security (CIS)","**What it asks for.** This control covers identifying, classifying, handling, retaining and disposing of data securely throughout its life. It expects a data management process, a data inventory and protective measures such as access restrictions and encryption matched to sensitivity.\n\n**In practice.** The organisation defines a classification scheme, maps where sensitive data lives and flows, and sets retention periods tied to legal and business need. Encryption is applied on end user devices, removable media and in transit, access is limited on a need to know basis, and data loss prevention is used where risk justifies it. Auditors look for the data inventory, classification policy, retention schedule, encryption coverage reports and evidence of secure disposal.\n\n**Common gaps.** Many organisations publish a classification policy but never apply labels or map data stores, especially in SaaS and file shares. Retention is rarely enforced, so old sensitive data accumulates and enlarges the impact of a breach.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fdata-protection","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},1536,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"government-encryption-backdoors-threaten-global-data-security","Government Encryption Backdoors Threaten Global Data Security","2026-10-17T14:20:19.334+00:00",{"slug":24,"title":25,"published_at":26},"cross-jurisdictional-law-enforcement-surveillance-of-political-activists-raises-civil-liberties-alar","Cross-Jurisdictional Law Enforcement Surveillance of Political Activists Raises Civil Liberties Alarms","2026-10-16T20:20:31.596+00:00",{"slug":28,"title":29,"published_at":30},"shadow-ai-personal-chatgpt-use-at-work-creates-data-exposure-risk","Shadow AI: Personal ChatGPT Use at Work Creates Data Exposure Risk","2026-10-16T16:21:15.148+00:00",{"slug":32,"title":33,"published_at":34},"ai-model-misappropriates-third-party-crypto-funds-to-complete-task","AI Model Misappropriates Third-Party Crypto Funds to Complete Task","2026-10-16T16:20:58.749+00:00",{"slug":36,"title":37,"published_at":38},"burger-king-japan-breach-exposes-11m-app-users-personal-data","Burger King Japan Breach Exposes 11M App Users' Personal Data","2026-10-16T15:20:48.695+00:00",{"slug":40,"title":41,"published_at":42},"burger-king-japan-app-breach-exposes-11m-member-records","Burger King Japan App Breach Exposes 11M Member Records","2026-10-16T12:21:23.341+00:00",{"slug":44,"title":45,"published_at":46},"xandr-fined-86m-for-processing-grindr-users-sensitive-data-without-consent","Xandr Fined €8.6M for Processing Grindr Users' Sensitive Data Without Consent","2026-10-16T10:20:42.098+00:00",{"slug":48,"title":49,"published_at":50},"ai-agents-accessed-live-sensitive-data-during-testing-due-to-exposed-credentials-and-excessive-permi","AI Agents Accessed Live Sensitive Data During Testing Due to Exposed Credentials and Excessive Permissions","2026-10-16T08:20:59.754+00:00",{"slug":52,"title":53,"published_at":54},"ai-chatbots-targeted-by-covert-political-influence-networks","AI Chatbots Targeted by Covert Political Influence Networks","2026-10-15T20:20:35.974+00:00",{"slug":56,"title":57,"published_at":58},"uk-legal-aid-agency-breach-exposes-47-years-of-sensitive-records","UK Legal Aid Agency Breach Exposes 47 Years of Sensitive Records","2026-10-15T16:20:35.876+00:00",{"slug":60,"title":61,"published_at":62},"vibetech-exposes-137m-records-in-unsecured-database","Vibetech Exposes 13.7M Records in Unsecured Database","2026-10-15T16:20:19.435+00:00",{"slug":64,"title":65,"published_at":66},"uk-legal-aid-agency-breach-exposes-decades-of-sensitive-records","UK Legal Aid Agency Breach Exposes Decades of Sensitive Records","2026-10-15T10:21:06.955+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",460,{"slug":74,"name":75,"problem":76,"stories":77},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",382,{"slug":79,"name":80,"problem":81,"stories":82},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",204,{"slug":84,"name":85,"problem":86,"stories":87},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",177,{"slug":89,"name":90,"problem":91,"stories":92},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",153,{"slug":94,"name":95,"problem":96,"stories":97},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",140,[99,105,110,115,120,125,130,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"gdpr","32","Article 32","Security of processing",716,{"family":5,"item":106,"code":107,"title":108,"together":109},"6","Control 6","Access Control Management",544,{"family":111,"item":112,"code":113,"title":113,"together":114},"itil","overview","ITIL",480,{"family":100,"item":116,"code":117,"title":118,"together":119},"5","Article 5(1)(f)","Principles relating to processing of personal data",463,{"family":100,"item":121,"code":122,"title":123,"together":124},"25","Article 25","Data protection by design and by default",446,{"family":126,"item":112,"code":127,"title":128,"together":129},"nist-privacy","Privacy Framework","NIST Privacy Framework",386,{"family":131,"item":132,"code":133,"title":134,"together":135},"nist-csf","pr-ds","PR.DS-1","Data Security",342,{"family":137,"item":138,"code":139,"title":140,"together":141},"nist-800-53","ac-2","AC-2","Account Management",314]