Recognises regulated data outside its requirement's scope

S-108 · Skill knobit · Activity: Register regulatory security requirements · Competence: Data security

A copy of regulated data in a data set the requirement does not list.

Can AI do this?

Not settled yet The benchmark tested this, but the models' answers do not settle yet whether they master it. 0 of 4 models in the current benchmark master it.

Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.

What it looks like in practice

Expected result: The copy, the data set and the requirement whose scope it enters

How it is assessed: Flags the deficient case and passes the acceptable one. Deficient: PAN copied into the legacy warehouse (DS-007) for card spend reporting; RQ-004 scope [DS-004] Acceptable: DS-007 in PCI scope with its jobs, readers and backups - or the PAN removed or truncated there

Also known as: Regulated data outside the requirement's scope

Related knobits

Builds on

• S-152 Explains which regulations cover which bank data
• S-153 Explains PCI DSS scope

Usually followed by

• S-131 Traces the scope consequence of a regulated data copy

All 17 knobits of Register regulatory security requirements.

Source: Review checklist 01-regulatory-requirements, row 8 (PCI scope; DMBOK)