ID.AM-3

Organizational communication and data flows are mapped

Identify · Asset Management

Manual Attestation

Compliance Score

Not Assessed

Documentation Maturity

1/ 5

Target: 2.5

Implementation Maturity

1/ 5

Target: 2.5

Control Description

The organization has identified and documented the types of information it processes, stores, and transmits, including sensitive data categories.

Remediation Guidance

Create a data classification policy. Map data flows between systems. Identify where personal data (GDPR), financial data, and business-critical information resides. Document in a data flow diagram.