{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Asset Management & Inventory"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-inventory-flows-unmapped","description":"No authoritative record of what personal data is held, where, who accesses it, and how it flows to processors/sub-processors and across borders — preventing risk assessment, DSR fulfilment, and enforcement of privacy obligations.","details":{"category":"privacy","impact":"medium","inherent_rating":"medium","likelihood":"high","risk_id":"data-inventory-flows-unmapped","taxonomies":["nist-privacy-risk"],"treatment":"mitigate"},"id":"risk:data-inventory-flows-unmapped","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-inventory-flows-unmapped","sourceIds":["coso-ic","gdpr","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Undocumented data inventory and unmapped data flows","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:30f758b6275b12c5b575bf448212126e4e9f0abd24d0dd5cf1c6aaf60de5afd7","properties":{"rationale":"Supplier-service inventory records only the processor/sub-processor leg, a partial contribution; the authoritative data inventory, RoPA, and flow diagrams (UC-02) are the operative defense for this privacy risk.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-05-11852f6d.json","sourceId":"uc:UC-ASSET-05","targetDetailPath":"/data/v1/records/risk-data-inventory-flows-unmapped-fd7746f8.json","targetId":"risk:data-inventory-flows-unmapped","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3dbe3964977b4cc816ce754ffec4cea6127c59fb731a7a2e69d01a9587f38f1e","properties":{"rationale":"Maintaining and annually reviewing a processing register creates the authoritative record of processing activities and purposes the risk says is missing.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-01-9fcf72e8.json","sourceId":"uc:UC-DATA-01","targetDetailPath":"/data/v1/records/risk-data-inventory-flows-unmapped-fd7746f8.json","targetId":"risk:data-inventory-flows-unmapped","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7bc4fe3700c246060090898e1c975ec1dca9ff55563fc601e501536f43d7c4ba","properties":{"rationale":"Recording every disclosure's recipient, categories, and purpose builds a partial authoritative record of outbound data flows.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-14-2c0be84c.json","sourceId":"uc:UC-DATA-14","targetDetailPath":"/data/v1/records/risk-data-inventory-flows-unmapped-fd7746f8.json","targetId":"risk:data-inventory-flows-unmapped","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bb9ab1025acf6800c2e99cf9e7284c0062c5e338301e2c4cd9b5ed13424002f2","properties":{"rationale":"Maintaining data inventories, RoPA, and data-flow diagrams directly produces the authoritative data-flow record this risk says is absent.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-02-6c6ac61b.json","sourceId":"uc:UC-ASSET-02","targetDetailPath":"/data/v1/records/risk-data-inventory-flows-unmapped-fd7746f8.json","targetId":"risk:data-inventory-flows-unmapped","type":"mitigates"}],"schemaVersion":1}