← CIS Controls v8 in plain English

3.3 IG1

Control 3 / Data Protection

Configure Data Access Control Lists

Think of it likeLabeling each filing cabinet with the exact names allowed to open it, so the tax folder opens only for the people who truly need it.

In plain English

Each set of data gets its own permission list naming who may read or change it, so access is granted file-by-file rather than to everyone at once.

Related CSF subcategories (unofficial mapping)

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties.PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected.