Additional Criteria for Confidentiality C1.1 Confidential information is protected during the Data used in nonproduction environments is not The entity creates test data using data masking system design, development, testing, protected from unauthorized access as software that replaces confidential information and change processes in accordance with test information prior to the creation of test with confidentiality commitments and databases. C1.2 Confidential information within the boundaries of Unauthorized access to confidential information Access to data is restricted to authorized the system is protected against unauthorized is obtained during processing. through access control software. Access access, use, and disclosure during input, rules are created and maintained by information retention, output, and disposition in security personnel during the application accordance with confidentiality commitments process. and requirements. Logical access other than through authorized application is restricted to administrators through database management system native security. Creation and modification of access control for the database management systems through the access provisioning process. Application level security restricts the ability to access, modify, and delete data to authenticated users who have been granted access through a record in the access control list. Creation and modification of access control records occurs through the access provisioning process. Unauthorized access to confidential information Application security restricts output to approved in output is obtained after processing. roles or user IDs.
Additional Criteria for Confidentiality C1.1 Confidential information is protected during the system design, development, testing, and change processes in accordance with confidentiality commitments and Data used in nonproduction environments is not protected from unauthorized access as The entity creates test data using data masking software that replaces confidential information with test information prior to the creation of test databases. C1.2 Confidential information within the boundaries of the system is protected against unauthorized access, use, and disclosure during input, retention, output, and disposition in accordance with confidentiality commitments and requirements. Unauthorized access to confidential information is obtained during processing. Access to data is restricted to authorized through access control software. Access rules are created and maintained by information security personnel during the application process. Logical access other than through authorized application is restricted to administrators through database management system native security. Creation and modification of access control for the database management systems through the access provisioning process. Application level security restricts the ability to access, modify, and delete data to authenticated users who have been granted access through a record in the access control list. Creation and modification of access control records occurs through the access provisioning process. Unauthorized access to confidential information in output is obtained after processing. Application security restricts output to approved roles or user IDs.
FINAL-ED-Trust-Services-Principles.docx