[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F3":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","3","Control 3","Data Protection",1542,"Center for Internet Security (CIS)","**What it asks for.** This control covers identifying, classifying, handling, retaining and disposing of data securely throughout its life. It expects a data management process, a data inventory and protective measures such as access restrictions and encryption matched to sensitivity.\n\n**In practice.** The organisation defines a classification scheme, maps where sensitive data lives and flows, and sets retention periods tied to legal and business need. Encryption is applied on end user devices, removable media and in transit, access is limited on a need to know basis, and data loss prevention is used where risk justifies it. Auditors look for the data inventory, classification policy, retention schedule, encryption coverage reports and evidence of secure disposal.\n\n**Common gaps.** Many organisations publish a classification policy but never apply labels or map data stores, especially in SaaS and file shares. Retention is rarely enforced, so old sensitive data accumulates and enlarges the impact of a breach.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fdata-protection","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},1605,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"qilin-ransomware-steals-personal-data-from-university-of-texas-at-arlington","Qilin Ransomware Steals Personal Data from University of Texas at Arlington","2026-11-13T18:20:39.241+00:00",{"slug":24,"title":25,"published_at":26},"record-uk-cyber-incident-reports-highlight-data-extortion-surge","Record UK Cyber Incident Reports Highlight Data Extortion Surge","2026-11-13T13:23:12.232+00:00",{"slug":28,"title":29,"published_at":30},"north-korean-fake-it-workers-reached-onboarding-and-accessed-sensitive-employee-data","North Korean Fake IT Workers Reached Onboarding and Accessed Sensitive Employee Data","2026-11-13T08:22:51.018+00:00",{"slug":32,"title":33,"published_at":34},"stolen-ai-api-keys-enable-covert-command-and-control-via-claude-code","Stolen AI API Keys Enable Covert Command-and-Control via Claude Code","2026-11-12T12:21:33.905+00:00",{"slug":36,"title":37,"published_at":38},"antifox-tool-exploits-weak-iis-configs-to-steal-aws-credentials","AntiFox Tool Exploits Weak IIS Configs to Steal AWS Credentials","2026-11-11T23:20:43.287+00:00",{"slug":40,"title":41,"published_at":42},"legacy-system-from-acquisition-becomes-entry-point-for-5m-ransomware-demand","Legacy System from Acquisition Becomes Entry Point for $5M Ransomware Demand","2026-11-11T22:20:43.504+00:00",{"slug":44,"title":45,"published_at":46},"vanderbilt-ransomware-attack-exposes-over-one-million-ssns","Vanderbilt Ransomware Attack Exposes Over One Million SSNs","2026-11-10T18:20:22.74+00:00",{"slug":48,"title":49,"published_at":50},"iris-ohyama-breach-77-million-records-exposed-via-third-party-cloud-service","Iris Ohyama Breach: 7.7 Million Records Exposed via Third-Party Cloud Service","2026-11-10T08:22:41.736+00:00",{"slug":52,"title":53,"published_at":54},"revolve-data-breach-exposes-15m-customers-payment-and-personal-data","Revolve Data Breach Exposes 1.5M Customers' Payment and Personal Data","2026-11-09T15:22:01.327+00:00",{"slug":56,"title":57,"published_at":58},"third-party-marketing-vendor-exposes-who-gives-a-crap-customer-data","Third-Party Marketing Vendor Exposes Who Gives A Crap Customer Data","2026-11-09T15:21:22.436+00:00",{"slug":60,"title":61,"published_at":62},"iris-plaza-cloud-breach-exposes-77-million-customers-via-third-party-service","Iris Plaza Cloud Breach Exposes 7.7 Million Customers via Third-Party Service","2026-11-09T13:20:40.563+00:00",{"slug":64,"title":65,"published_at":66},"ai-powered-secret-harvesting-exposes-github-credentials-in-minutes","AI-Powered Secret Harvesting Exposes GitHub Credentials in Minutes","2026-11-09T11:22:24.281+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",481,{"slug":74,"name":75,"problem":76,"stories":77},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",401,{"slug":79,"name":80,"problem":81,"stories":82},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",214,{"slug":84,"name":85,"problem":86,"stories":87},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",188,{"slug":89,"name":90,"problem":91,"stories":92},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",162,{"slug":94,"name":95,"problem":96,"stories":97},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",156,[99,105,110,115,120,125,130,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"gdpr","32","Article 32","Security of processing",774,{"family":5,"item":106,"code":107,"title":108,"together":109},"6","Control 6","Access Control Management",550,{"family":111,"item":112,"code":113,"title":113,"together":114},"itil","overview","ITIL",480,{"family":100,"item":116,"code":117,"title":118,"together":119},"5","Article 5(1)(f)","Principles relating to processing of personal data",463,{"family":100,"item":121,"code":122,"title":123,"together":124},"25","Article 25","Data protection by design and by default",446,{"family":126,"item":112,"code":127,"title":128,"together":129},"nist-privacy","Privacy Framework","NIST Privacy Framework",386,{"family":131,"item":132,"code":133,"title":134,"together":135},"nist-csf","pr-ds","PR.DS-1","Data Security",343,{"family":5,"item":137,"code":138,"title":139,"together":140},"13","Control 13","Network Monitoring and Defense",320]