DATA ASSESSMENT SUMMARY This component allows the auditor to identify what sensitive data exists for the organization, where it is stored, and how it is transferred. PURPOSE Sensitive files are often stored across multiple devices with different levels of security. A data assessment allows the auditor to recommend secure storage solutions which best meet the organizations risk assessment and workflow needs. While the auditor has insight on some of this based on the Network Access and Network Mapping work, cross-staff understanding and agreement on what constitutes sensitive data will support later organizational change. An adversary who obtains a laptop, workstation, or backup drive will be able to read or modify sensitive information on the device, even if that staff member has set a strong account password. This applies to threats involving loss, theft, and confiscation, but also to "checkpoint" scenarios in which they may only have access for a few minutes. Furthermore, in the event of a burglary or office raid, an adversary could obtain all sensitive information on the organization's devices, possibly even undetected. THE FLOW OF INFORMATION Information Threats Results Threats Activity Actors Actors Capacity Capacity Activities Activities Vulnerabilities Vulnerabilities Barriers Barriers Assets Assets Data Assessment Information Flow GUIDING QUESTIONS What are the most important data sets to keep available? Are there backups? What are the most important data sets to keep private? How does the organization currently determine who should have access to data? Is there currently anyone who has access to data who should not? Does the staff agree on what constitutes sensitive data? What data does each staff member need to be able to access in order to do their job? APPROACHES Data Mapping Activity: Have staff identify where that data is currently (what devices/physical locations), who has access (physical, login, permissions), and who needs to have access to get the organizations work completed. Page 103 of 240