Data Masking
What is Data Masking?
A technique that replaces sensitive data with realistic but fictitious values to protect confidential information while maintaining data usability for testing or analytics.
Frameworks that govern data masking
What the standards actually require on data masking
Requirements naming data masking across 5 standards, quoted from the control text.
Data masking is to be applied as directed by the access control policy, related topic policies and what the business needs, with applicable law taken into account.
iso-27001-2022::8.11 · Data masking →Data masking is to be applied as directed by the access control policy, related topic policies and what the business needs, with applicable law taken into account.
iso-27002-2022::8.11 · Data masking →Health guidance: the ISO/IEC 27002 guidance applies except items b) and c) of its list of considerations for implementing masking, which for health are covered in 5.34; ISO 25237 covers pseudonymization in health.
iso-27799-2025::8.11 · 8.11 Data masking →Users who do not need exact sensitive values should see obfuscated, masked, banded or noise-added values with irrelevant attributes removed;
singapore-government-instruction-manual-on-ictss-management-im8::DSP-48 · Partially hide data: masking and dataset partitioning →Sensitive data is protected at rest, at least in an ad hoc way, using techniques such as authentication, authorisation, encryption and data masking.
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-5a · ARCHITECTURE-5a: Sensitive data protected at rest →Questions people ask about data masking
What is Data Masking?
Why is Data Masking important for compliance?
Which compliance frameworks address Data Masking?
Where can I learn more about Data Masking?
See how Data Masking applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.