6.7.2 Confidentiality measures

What this heading covers

The population is data assets and the people or systems entitled to them. A measure can be built from access tests, from the proportion of assets classified and protected, or from incidents of disclosure. The first is preventive and the others are retrospective. The draft keeps confidentiality at the product level, so the measure is about the product's behaviour, not about the organisation's access policy. A test should include the negative case: an unauthorised attempt that must fail.

Record position: family 21 of 40 in clause 6, under 6.7 Security, which carries 6 families. It is one of the 40 families a programme has to map its measures to, and its elements are listed below. The heading is 6.7.2 in the public contents; the text behind it is not public.

How a measure for this family is built

Count the access attempts that were correctly allowed or refused as the numerator over the attempts tested, and report the unauthorised attempts separately because a false allow is a different failure from a false refuse. For an asset measure, divide the classified and protected assets by the assets in scope.

What to put in place before publication

1. Test the refusal as carefully as the allowance.
2. Keep the asset list current, because an unlisted asset is outside the measure.

Evidence to keep

Two questions to ask

• Which attempts were refused, not only allowed?
• How many assets are in scope, and how many are classified?

Where teams usually fall short

• An access review that checks who has access but never tries an unauthorised request.

What the number cannot tell you

It cannot tell you about a disclosure path nobody tested. Confidentiality is only evidenced against the attempts in the population.

What happens next

Integrity is the counterpart: data that is not disclosed can still be changed.