ISO 27001 A.8.11: Data masking

Start by mapping where data masking is needed. The usual suspects: non-production environments (dev, test, staging, training), analytics and reporting that do not need individual-level sensitive data, application display screens showing partial information, data shared with third parties, and anywhere data minimisation regulations apply. Choose the right masking technique for each scenario. Static data masking creates a permanently masked copy for non-production use. Dynamic data masking applies masking in real-time at the access layer without changing stored data. Format-preserving encryption keeps the data format intact while making content unreadable. Tokenisation replaces data with tokens mapped to the original via a secure vault - particularly useful for payment card data. For non-production environments, build automated masking pipelines. Never copy production data directly to dev or test without masking it first. Make sure masked data keeps referential integrity and correct formats so applications still function. Verify that the masking is truly irreversible without access to the masking keys. Implement display masking in your applications. Configure screens to show only partial sensitive data to users who do not need the full value. A customer service agent seeing the last four digits of a card number can still verify a transaction. Build proper access controls for the few roles that genuinely need to see unmasked data. Document your masking rules clearly. Define which data elements require masking, what technique applies to each, who may access unmasked data, and how masked datasets are created. Review these rules regularly as your data usage patterns change. Test that your masking actually works. Verify masked data cannot be reversed or re-identified through cross-referencing. Check that masked datasets keep the statistical properties needed for their purpose. Validate that applications run correctly against masked data in non-production environments.