A.8.11 Data Masking

The implementation of data masking as a good practice or to fulfill a requirement will depend on the results of risk assessment (i.e., relevant risks), and the existence of applicable legal requirements (e.g., laws, regulations, or contracts).

In case you have relevant risks or legal requirements demanding the implementation of data masking, implementing control A.8.1.1 control would be a requirement, otherwise, its implementation could be seen as a good practice.

Regarding its balance with the business day to day operation, you should evaluate the positive impact of its implementation (e.g., reduction of costs due to information security incidents) against negative effects (e.g., reduction in processes performance or productivity), so you can evaluate the extension on ho implement the control.

For example, for some processes, you may implement heavy masking practices and still have acceptable operational results, and for others, even the slighted practices won’t be worth it (and for these cases you may have to accept the risk, since applying the control will bring more problems than solving them).

This article will provide you with further explanation about applying controls:

• Risk treatment https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#treatment