What it asks for. This control expects data masking to be used in line with the organisation's access control policy, other related policies and business requirements, taking applicable legislation into account.
In practice. Good practice means identifying where sensitive data, especially personal data, is used beyond its primary purpose, such as in test environments, analytics or support tools, and applying techniques such as masking, pseudonymisation or anonymisation. The chosen method is matched to the risk of re-identification. Auditors look for rules on when masking is required and evidence that it is applied, for example in test data.
Common gaps. Common gaps are copies of production data used for testing without masking, and pseudonymised data treated as if it were anonymous.