{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Incident Management & Response"],"inherent_rating":"high","taxonomy":["iso-27005-threat","nist-800-30-threat-event","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-breach-unauthorized-disclosure","description":"Unauthorized disclosure of information to parties not entitled to receive it, whether by insecure controls (insecurity), spillage, or authorized users induced to expose data — resulting in identity theft, economic loss, and loss of trust.","details":{"category":"privacy","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"data-breach-unauthorized-disclosure","taxonomies":["iso-27005-threat","nist-800-30-threat-event","nist-privacy-risk"],"treatment":"mitigate"},"id":"risk:data-breach-unauthorized-disclosure","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-breach-unauthorized-disclosure","sourceIds":["aiuc-1","ccpa","gdpr","hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-ai-tevv-athlon","nist-csf-2","soc2"],"sourceUrl":null,"title":"Unauthorized disclosure / breach of sensitive information","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1dac742b744aa5f113abc6f1763362dfe41de89aa549038f21b60fa196d1427f","properties":{"rationale":"Destroying data past its retention shrinks the volume of data exposable in any breach.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","sourceId":"uc:UC-DATA-09","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3ad8409d622936a6e22d988071cb26870f667401572e194c443f2e7f32176cc6","properties":{"rationale":"A complete, accurate disclosure register enables detection of disclosures to unentitled parties.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-14-2c0be84c.json","sourceId":"uc:UC-DATA-14","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:47cc01fbac20185035f09875fdc49f3b3e2d1f6a738b8ed24034b96703d09ae7","properties":{"rationale":"Masked/pseudonymized data lowers the impact of any disclosure by limiting identifiability of exposed data.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-12-c5a5999a.json","sourceId":"uc:UC-DATA-12","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6e6b074dacca375c431c27e3bc8f8677f0f0d41ce5d70d05ee64f8283b855053","properties":{"rationale":"Enforcing approved information-flow authorizations and DLP directly prevents data leaking to parties not entitled to it.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-11-baf71fe4.json","sourceId":"uc:UC-DATA-11","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7be65d171a14691c5038495241b15ec5a9c93b5ae7d403edc5cb719b0de75d31","properties":{"rationale":"Validating which data/records were exposed scopes the disclosure so response, remediation, and notification can be targeted.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-05-0e11ebf5.json","sourceId":"uc:UC-IR-05","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7f3b3fe0a6bcff3e2828618adf67b373a4593c4a10293f4283637df72166e785","properties":{"rationale":"Binding third parties to permitted-use, safeguard, and breach-notification commitments with periodic assessment directly reduces unauthorized disclosure via vendors.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-16-57ae2c9a.json","sourceId":"uc:UC-DATA-16","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:afb35d46fe00047a2b4dd91d40ed59ad27aca67fbfc4e7a9f3e23434d3dcf2dc","properties":{"rationale":"Heightened safeguards on special-category data reduce the likelihood and impact of exposing the most sensitive records.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-04-2a08628d.json","sourceId":"uc:UC-DATA-04","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b901e575179c2da6ed1ff8d7830beb5686674e053f3faefdc696464fb062515a","properties":{"rationale":"Logging and analyzing unauthorized disclosures is the corrective response that limits their harm and recurrence.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-15-efb7b99a.json","sourceId":"uc:UC-DATA-15","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b9f010e652a86ba096c55275dae7215b6d336e955a7220132db8747e27fd35c9","properties":{"rationale":"Implementing reasonable admin/technical/physical safeguards sized to data volume/sensitivity directly reduces unauthorized disclosure/breach.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-13-c09befaf.json","sourceId":"uc:UC-DATA-13","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c30f912201dd177435429da28a4c4815dfd71e9d8b2514a6f647927c4f69df1e","properties":{"rationale":"Containing the incident stops ongoing unauthorized exfiltration and eradication closes the weakness enabling disclosure (RS.MI mitigation).","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-06-0b166c2a.json","sourceId":"uc:UC-IR-06","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e2620ed554135eba78e6935c257e090b67fcf286ca9580116cf4132dbea67372","properties":{"rationale":"Isolating and eradicating spilled sensitive/regulated information from systems and backups directly reduces the extent of unauthorized disclosure (spillage named in the risk).","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-11-6234912d.json","sourceId":"uc:UC-IR-11","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f0a001848fbb08cf57cad5f88ce477ea577386aa9cb67456fd5c04429cb6872f","properties":{"rationale":"Securing and sanitizing physical media reduces unauthorized disclosure of data carried on that media.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-10-e7ad28aa.json","sourceId":"uc:UC-DATA-10","targetDetailPath":"/data/v1/records/risk-data-breach-unauthorized-disclosure-3b1c296c.json","targetId":"risk:data-breach-unauthorized-disclosure","type":"mitigates"}],"schemaVersion":1}