2cac8686_plication_Security_and_Privacy__Derived_Security_Controls
Processing data in inappropriate locations [Derived Security Controls] 
Identify and maintain an inventory of all locations where personal data is stored, processed and transmitted Do not allow unauthorised access (e.g. public access) to personal data Do not use production data in development and test systems Incorporate personal data access into systems design processes Use network segmentation to assist with limiting access to personal data (e.g. segregate non production systems, segregate teams or departments with access to sensitive personal data) Use redundancy/diversity to protect against accidental loss or destruction of, or damage to, personal data Create and maintain policies for the storage, processing and transmission of personal data Create, maintain and use procedures for transfers of personal data Do not place copies of personal data in unprotected locations Enforce appropriate access control in custom applications (e.g. websites) Provide training about the access, use and transfers of personal data Monitor transfers of personal data
Privacy : Application Security and Privacy
Derived Security Controls