DSP · Data Security and Privacy Lifecycle Management

DSP-10Cloud & AI Related

Sensitive Data Transfer

Specification

Define, implement and evaluate processes, procedures and technical measures that ensure any transfer of personal or sensitive data is protected from unauthorized access and only processed within scope as permitted by the respective laws and regulations.

Threat coverage

Model manipulation

Data poisoning

Sensitive data disclosure

Model theft

Model/Service Failure

Insecure supply chain

Insecure apps/plugins

Denial of Service

Loss of governance

Architectural relevance

Physical infrastructure

Network

Compute

Storage

Application

Data

Lifecycle

Preparation

Resource provisioning, Team and expertise

Development

Design, Guardrails

Evaluation

Evaluation, Validation/Red Teaming

Deployment

Orchestration, AI Services supply chain

Delivery

Operations, Maintenance, Continuous monitoring

Retirement

Data deletion, Archiving

Ownership / SSRM

Owned by the Customer (AIC)

The Customer (AIC) is responsible and accountable for the design, development, implementation, and enforcement of the control to mitigate security, privacy, or compliance risks associated with Large Language Model (LLM)/GenAI technologies services or products they consume.

Model

Owned by the Customer (AIC)

Orchestrated

Owned by the Customer (AIC)

Application

Owned by the Customer (AIC)

Implementation guidelines

[All Actors]
1. Protect any datasets and outputs the actor transmits during cross-system transmission.

2. Secure service-to-service inference and plugin data flow under the actor’s control through authenticated, encrypted channels and strict access controls.

3. Secure user data transfers, log handling and consent-based usage for any user data the actor processes.

4. Classify, encrypt and contractually limit transferred data for any transfers the actor initiates or receives.

5. Provide secure-by-default networking, encryption and transfer logs.

Auditing guidelines

1. Examine the CSP’s procedures and technical requirements for securing and legally transferring personal and sensitive data. Establish that this process and key controls comply with the CSP’s data privacy and security policy.

2. Establish whether the CSP has documented the roles and responsibilities for this process.

3. Select a range of personal and sensitive data transfers to confirm that each transfer adhered to the CSP’s policy, procedures, and controls. Confirm that all relevant evidence was formally documented.

4. Verify that data transfers are protected from unauthorized access using encryption, secure communication channels, and access controls.

5. Verify compliance with relevant data protection laws (e.g., GDPR, CCPA) and organizational policies throughout the data transfer and processing activities.

6. Verify that regular assessments and audits are conducted to evaluate the effectiveness of data transfer and processing measures and identify potential risks.

7. Verify that all processes, procedures, and technical measures related to data transfer and processing are thoroughly documented and regularly updated to reflect changes in laws and regulations.

8. Obtain a sample of the technical measures implemented by the CSP to determine if those measures adhere to the CSP’s data privacy and security policy.

9. Determine how the CSP ensures that all third-party providers protect the transfer of personal or sensitive data.

10. Verify implementation of encryption protocols (e.g., TLS 1.2+) for all network paths that transfer sensitive data.

11. Assess technical measures enforcing geographical data residency requirements, including documentation of data storage locations.

12. Review access control mechanisms for infrastructure components that handle sensitive data transfers, verifying the principle of least privilege implementation.

13. Evaluate network monitoring capabilities for detecting unauthorized sensitive data transfers.

14. Verify implementation of secure API gateways and other transfer boundary protections.

15. Assess documentation and technical implementation of data transfer logging and monitoring for compliance verification.

Standards mappings

ISO 42001No Gap

42001: A.2.2 AI Policy
42001: A.2.4. Review of AI Policy
42001: A.2.3 Alignment with other organizational policies
42001: A.7.3 Acquisition of data
27001: A.5.1 Policies for information security
27001: A.5.14 - Information transfer
27001: A.5.36 - Monitor Compliance
27001: A.5.37 Documented operating procedures
27001: A.7.10 - Storage media
27002: 5.1 Policies for information security
27002: 5.14 - Information transfer
27002: 5.37 Documented operating procedures
27002: 7.10 - Storage media

Addendum

N/A

EU AI ActPartial Gap

Article 10 (2) (e)
Article 23

Addendum

Data transfer is mentioned but specific technical protection measures for data transfer are missing.

NIST AI 600-1Partial Gap

MP-4.1-001
MP-4.1-009

Addendum

NIST AI 600-1 does not specifically mention the DSP-10 topic of the "transfer" of personal or sensitive data being protected from unauthorized use.

BSI AIC4No Gap

COS-08

Addendum

N/A

AI-CAIQ questions (1)

DSP-10.1

Are processes, procedures, and technical measures defined, implemented, and evaluated that ensure any transfer of personal or sensitive data is protected from unauthorized access and only processed within scope as permitted by the respective laws and regulations?