ID.AM-07 says inventories of data and corresponding metadata for designated data types are maintained. The word designated matters. You are not asked to catalog every file. You choose the data types that carry risk, such as personal data, payment data, health data or your own intellectual property, and keep a reliable record of where they live and who owns them.
CSF is voluntary guidance. There is no CSF certification.
What good looks like
A short list of designated data types exists. For each, you can say which systems store it, who owns it, how it is classified, where it is geographically stored and where it came from. New instances are found by discovery, not only by someone remembering to tell you.
How to implement it
- Choose designated data types. Most small companies need four to six: customer personal data, credentials and secrets, financial records, employee records, source code and any regulated data.
- Define classification labels, such as public, internal, confidential and restricted, with one line on handling rules each.
- Build a data map: for each type, list the systems, databases, buckets and SaaS tools that hold it.
- Record metadata per store: data owner, region, retention period and source.
- Run discovery on a schedule. Scan buckets, databases and shared drives for patterns such as email addresses, card numbers and API keys, and add what you find.
- Apply labels or tags so tooling can act on them, for example blocking a public bucket tagged restricted.
Evidence to collect
- The designated data types list and classification scheme.
- The data map with owner, region and source columns.
- Discovery scan results and what was done with new findings.
- Examples of tags applied in storage or SaaS tools.
Common gaps
- The data map shows the production database and misses exports, backups and analytics copies.
- Secrets in code and chat are not treated as a data type.
- Owners are listed as "engineering" instead of a named person.
- Classification exists in a policy and not on the data.
Quick check
Do we have to inventory all data?
No. The outcome refers to designated data types. Choose the ones whose loss or exposure would hurt, document why, and expand over time.
Why track provenance?
Because you need to know where data came from to honor deletion requests, assess quality and trace an exposure back to its source.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
