ASVS 5.0 V14.1.2 is a Level 2 requirement. Once data has protection levels, every level needs a documented set of requirements. At minimum these cover encryption, integrity checks, retention, logging, access to logs that hold sensitive data, database level encryption, privacy techniques and other confidentiality needs.
A level name without rules is a label, not a control.
Why it matters
Without written rules, each team guesses. One service encrypts a field and another stores the same field in plain text and logs it. Auditors, new hires and incident responders all need one place to read what "restricted" actually means.
How to implement it
Write a short table, one row per level, one column per control:
| Control | Confidential | Restricted |
|---|---|---|
| Encryption in transit | TLS required | TLS required |
| Encryption at rest | Disk level | Field level, managed keys |
| Retention | 1 year | 90 days |
| Logging | Mask values | Never log |
| Log access | Engineers on call | Security team only |
| UI display | Full for owner | Masked until requested |
Link each cell to the implementing code or setting. Store the document in version control and name an owner. Review it when regulations or architecture change.
How to test it
Choose one data element per level. Walk the table and verify each rule in the running system: look at the stored value, the log line, the backup and the UI. Any mismatch is either a defect or an out of date document. Fix whichever is wrong.
Common mistakes
- Writing the document and never checking the system against it.
- Leaving out logs, even though they are where most leaks happen.
- Rules that cannot be tested, such as "handle data carefully".
Quick check
Who should own this document?
A named person or team who can approve changes, usually application security or the data owner for that system.
