DSP

Data Security and Privacy Lifecycle Management

Domain definition — mapping in progress (source: AI Controls Matrix (AICM) Introductory Guidance).

Control objectives

160

Skills

Cross-cutting

—

Objectives fitted

Assess a function on this domain

AISMM maturity context

Data Security · Structural domain

L1 InitialL2 RepeatableL3 DefinedL4 CapableL5 Efficient

A lens, not a partition. How AISMM adoption works →

Control objectives

The exact things this domain must do. Each carries an authoritative crosswalk to 9 external control sets (Cloud Security Alliance (CSA) AI Controls Matrix (AICM) v1.1.0). Fitted skills are drawn from the pool below as fits are evidenced.

Security and Privacy Policy and ProceduresDSP-01

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 1 step

Cloud Service Provider — 15 steps

Application Provider — 6 steps

Model Provider — 7 steps

Orchestrated Services Provider — 12 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Secure DisposalDSP-02

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 18 steps

Application Provider — 9 steps

Model Provider — 13 steps

Orchestrated Services Provider — 14 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data InventoryDSP-03

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 16 steps

Application Provider — 8 steps

Model Provider — 14 steps

Orchestrated Services Provider — 14 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data ClassificationDSP-04

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 17 steps

Application Provider — 6 steps

Model Provider — 11 steps

Orchestrated Services Provider — 13 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data Flow DocumentationDSP-05

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 17 steps

Application Provider — 6 steps

Model Provider — 11 steps

Orchestrated Services Provider — 12 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data Ownership and StewardshipDSP-06

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 20 steps

Application Provider — 6 steps

Model Provider — 11 steps

Orchestrated Services Provider — 12 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data Protection by Design and DefaultDSP-07

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 4 steps

Cloud Service Provider — 19 steps

Application Provider — 7 steps

Model Provider — 13 steps

Orchestrated Services Provider — 14 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data Privacy by Design and DefaultDSP-08

Crosswalk

ISO/IEC 42001EU AI ActCCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 23 steps

Application Provider — 18 steps

Model Provider — 18 steps

Orchestrated Services Provider — 16 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data Protection Impact AssessmentDSP-09

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 16 steps

Application Provider — 14 steps

Model Provider — 12 steps

Orchestrated Services Provider — 12 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Sensitive Data TransferDSP-10

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 18 steps

Application Provider — 10 steps

Model Provider — 14 steps

Orchestrated Services Provider — 14 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Personal Data Access, Reversal, Rectification and DeletionDSP-11

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 12 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 11 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Limitation of Purpose in Personal Data ProcessingDSP-12

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 18 steps

Application Provider — 11 steps

Model Provider — 14 steps

Orchestrated Services Provider — 15 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Personal Data Sub-processingDSP-13

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 16 steps

Application Provider — 11 steps

Model Provider — 14 steps

Orchestrated Services Provider — 15 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Disclosure of Data Sub-processorsDSP-14

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 9 steps

Application Provider — 6 steps

Model Provider — 5 steps

Orchestrated Services Provider — 6 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Limitation of Production Data UseDSP-15

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 20 steps

Cloud Service Provider — 10 steps

Application Provider — 6 steps

Model Provider — 6 steps

Orchestrated Services Provider — 6 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data Retention and DeletionDSP-16

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 19 steps

Application Provider — 14 steps

Model Provider — 14 steps

Orchestrated Services Provider — 14 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Sensitive Data ProtectionDSP-17

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 28 steps

Cloud Service Provider — 11 steps

Application Provider — 7 steps

Model Provider — 7 steps

Orchestrated Services Provider — 7 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Disclosure NotificationDSP-18

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 18 steps

Application Provider — 13 steps

Model Provider — 13 steps

Orchestrated Services Provider — 13 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data LocationDSP-19

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 10 steps

Cloud Service Provider — 17 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data Provenance and TransparencyDSP-20

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4

Implementation & auditing guidance

Shared implementation — 17 steps

Cloud Service Provider — 14 steps

Application Provider — 14 steps

Model Provider — 14 steps

Orchestrated Services Provider — 14 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data Poisoning Prevention & DetectionDSP-21

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4

Implementation & auditing guidance

Shared implementation — 3 steps

Cloud Service Provider — 10 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Privacy Enhancing TechnologiesDSP-22

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4

Implementation & auditing guidance

Shared implementation — 4 steps

Cloud Service Provider — 8 steps

Application Provider — 8 steps

Model Provider — 8 steps

Orchestrated Services Provider — 8 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data Integrity CheckDSP-23

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4

Implementation & auditing guidance

Shared implementation — 4 steps

Cloud Service Provider — 8 steps

Application Provider — 8 steps

Model Provider — 8 steps

Orchestrated Services Provider — 8 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data Differentiation and RelevanceDSP-24

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4

Implementation & auditing guidance

Shared implementation — 3 steps

Cloud Service Provider — 4 steps

Application Provider — 7 steps

Model Provider — 18 steps

Orchestrated Services Provider — 7 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Standard names and gap levels shown; the specific clause references and full control text are available to the owner.

Skill pool — DSP

Implementing Data Loss Prevention With Microsoft PurviewHandling GDPR Restriction Of Processing RequestsGDPR Consent For International Data TransfersConfiguring Google Consent Mode V2 Eea ComplianceDetecting PII In Unstructured Data Ner Presidio Ocr PipelinesMaintaining Cross Border Transfer RecordsImplementing NIST 800 88 Secure Data DestructionGDPR Codes Of Conduct Article 40GDPR Joint Controller Article 26 ArrangementHIPAA Privacy Rule Covered Entity CompliancePII Detection Pipeline NLP ScanningGDPR Data Protection By Default Art25

Sample view. 12 of 160 skill names shown; the full list is available to the owner.

The other AICM domains

A&AAudit & Assurance AISApplication & Interface Security BCRBusiness Continuity Management and Operational Resilience CCCChange Control and Configuration Management CEKCryptography, Encryption & Key Management DCSDatacenter Security GRCGovernance, Risk and Compliance HRSHuman Resources IAMIdentity & Access Management IPYInteroperability & Portability I&SInfrastructure Security LOGLogging and Monitoring MDSModel Security SEFSecurity Incident Management, E-Discovery, & Cloud Forensics STASupply Chain Management, Transparency, and Accountability TVMThreat & Vulnerability Management UEMUniversal Endpoint Management

Assess a function on this domain →See how a fit gets deployed