Security & compliance cross reference

Start by conducting your security and compliance review and feature definition (see 3.2 Security & compliance). This activity creates a cross-referenced catalogue data sources and types, security features and compliance requirements.

Other security references

• Why you need a zero trust architecture
• Planning ahead with an AI readiness plan
• Why you need a Zero Trust Architecture (and how to get one)

Data type cross reference

Data classification exercise. In this activity you will identify all of your data types and sources, and classify each one based on sensitivity, how the data flows, and how long you need to retain the data.

1. Identify all data types in your system (customer PII, financial data, intellectual property, health records, commerce data, etc).
2. Classify data based on sensitivity levels to indicate how each element must be controlled (e.g., public, internal, confidential, restricted).
3. Document data flows between components to show how information moves through your system (this should already be part of your context map, but be sure to annotate and keep it up to date).
4. Define retention periods for each data type, so you know how long you need to keep it, and when you need to destroy it.

Example

Security & compliance features

Itemize your security and compliance features. This document should correlate security or compliance needs with their respective requirements, designs, and use cases. Cross reference links to use cases, relevant designs, verification methods and tests, should be specified with each item. Where appropriate and as mandated by, e.g., legislation, deadlines should be identified.

Example