DSP · Data Security and Privacy Lifecycle Management

DSP-03Cloud & AI Related

Data Inventory

Specification

Create and maintain a data inventory, at least for any sensitive, regulated and personal data. Review and update the inventory at least annually or upon significant changes.

Threat coverage

Model manipulation

Data poisoning

Sensitive data disclosure

Model theft

Model/Service Failure

Insecure supply chain

Insecure apps/plugins

Denial of Service

Loss of governance

Architectural relevance

Physical infrastructure

Network

Compute

Storage

Application

Data

Lifecycle

Preparation

Data storage, Data collection

Development

Design

Evaluation

Deployment

Orchestration, AI Services supply chain

Delivery

Operations, Maintenance, Continuous monitoring

Retirement

Data deletion

Ownership / SSRM

Owned by the Customer (AIC)

The Customer (AIC) is responsible and accountable for the design, development, implementation, and enforcement of the control to mitigate security, privacy, or compliance risks associated with Large Language Model (LLM)/GenAI technologies services or products they consume.

Model

Owned by the Customer (AIC)

Orchestrated

Owned by the Customer (AIC)

Application

Owned by the Customer (AIC)

Implementation guidelines

[All Actors]
1. Inventory data moving between services or cached within the environment the actor controls.

2. Classify and track prompt / response data tied to users that the actor stores or processes.

3. Inventory customer data used in AI workflows that the actor handles.

4. Enable classification, discovery and tagging at the storage level.

[Shared among: MP, OSP, CSP]
1. Maintain metadata & lineage for training / test / fine-tuning data.

Auditing guidelines

1. Examine the CSP’s procedures and technical requirements for the population and management of its data inventory. Establish that this process and key controls comply with the CSP’s data privacy and security policy. Establish whether the CSP has documented the roles and responsibilities for this process.

2. Select a sample of entries to ensure they have been recorded correctly on the inventory. The sample must include a proportion of sensitive and personal data entries.

3. Assess whether data inventory management meets the CSP’s expectations from the defined procedures and technical requirements.

4. Examine measure(s) that evaluate(s) this process and determine if the measure(s) address(es) implementation of the process/control requirement(s) as stipulated.

5. Determine whether the CSP evaluates third-party data inventory practices and assigns each one an appropriate risk level.

6. Verify that a comprehensive data inventory is created, including all sensitive and personal data.

7. Verify that data sources, types, usage, and ownership are identified and documented.

8. Verify that the data inventory is maintained and updated regularly to reflect changes in data assets and processing activities.

9. Verify compliance with relevant data protection laws (e.g., GDPR, CCPA) and organizational policies throughout the data inventory process.

10. Review mechanisms provided to customers for identifying and locating their data within the infrastructure, such as metadata services, tagging capabilities, or data mapping tools.

11. Verify that the CSP provides customers with documentation about data storage locations, particularly for jurisdictional or compliance purposes.

Standards mappings

ISO 42001No Gap

42001: A.4.3 Data Resources
42001: A.7.3 Acquisition of Data
42001: A.2.3 Alignment with other organizational policies
27001: A.5.9 - Inventory use of information and other associated assets
27001: A.8.12 - Data leakage prevention (DLP)
27002: 5.9 - Inventory use of information and other associated assets
27002: 8.12 - Data leakage prevention (DLP)

Addendum

N/A

EU AI ActNo Gap

Article 10 (2)
Article 11 (1) (d)

Addendum

N/A

NIST AI 600-1Partial Gap

MP-2.3-002

Addendum

NIST does not address the DSP-03 topic of "review and update the inventory at least annually or upon significant changes."

BSI AIC4No Gap

DM-01

Addendum

N/A

AI-CAIQ questions (2)

DSP-03.1

Are data inventories created and maintained at least for any sensitive, regulated, and personal data?

DSP-03.2

Are inventories reviewed and updated at least annually or upon significant changes?