Data Protection Documentation
V14.1.1
Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 116, 117, 20, 204, 31, 37, 55, 94
V14.1.2
Verify that all sensitive data protection levels have a documented set of protection requirements. This must include (but not be limited to) requirements related to general encryption, integrity verification, retention, how the data is to be logged, access controls around sensitive data in logs, database-level encryption, privacy and privacy-enhancing technologies to be used, and other confidentiality requirements.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 116, 117, 20, 204, 31, 37, 55, 94
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
