{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Secure Configuration & Change Management","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-CONFIG-10","description":"Identify and document the location of information and the specific system components on which it is processed and stored, including designated data types such as personally identifiable information. Develop and maintain a map of system data actions covering collection, processing, storage, and transmission, and update location and mapping documentation upon change.","details":{"control_category":"administrative","control_type":"preventive","domain":"Secure Configuration & Change Management","guidance":[],"members":[{"control_id":"CM-12","coverage":"partial","delta":"documenting which users have access to components where information resides","framework":"nist-800-53","relationship":"intersects_with"},{"control_id":"CM-13","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"E011","coverage":"partial","delta":"a customer-facing record of the regions and sub-processors where AI inputs and outputs are processed and stored","framework":"aiuc-1","relationship":"intersects_with"}],"statement":"Identify and document the location of information and the specific system components on which it is processed and stored, including designated data types such as personally identifiable information. Develop and maintain a map of system data actions covering collection, processing, storage, and transmission, and update location and mapping documentation upon change.","title":"Map where information resides and how data is processed","unified_id":"UC-CONFIG-10"},"id":"uc:UC-CONFIG-10","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-CONFIG-10","sourceIds":["aiuc-1","nist-800-53"],"sourceUrl":null,"title":"UC-CONFIG-10 — Map where information resides and how data is processed","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:62ee50758e0b81e396915ba8c0b9305869254544245178f49193c59b165b6bac","properties":{"control_id":"CM-13","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-config-10-921518b8.json","sourceId":"uc:UC-CONFIG-10","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-cm-13-2ad445c6.json","targetId":"ctrl:nist-800-53:CM-13","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6abb9f15b63865731bb5f32cd8bc9de1cb9505b402c2ae7e7442bb32f0a8fa9f","properties":{"control_id":"CM-12","coverage":"partial","delta":"documenting which users have access to components where information resides","framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-config-10-921518b8.json","sourceId":"uc:UC-CONFIG-10","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-cm-12-b618fa1b.json","targetId":"ctrl:nist-800-53:CM-12","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:aecd717d6185bfe73df9e6b08b317c80a2a700620a5315a7d9f2548452e607d2","properties":{"control_id":"E011","coverage":"partial","delta":"a customer-facing record of the regions and sub-processors where AI inputs and outputs are processed and stored","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-config-10-921518b8.json","sourceId":"uc:UC-CONFIG-10","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-e011-56758692.json","targetId":"ctrl:aiuc-1:E011","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cfd1d7e7e7b376a1f9a608225b32a16d5c496ca669393524c03ae7523a1a15b1","properties":{},"sourceDetailPath":"/data/v1/records/wf-c38-485b6728.json","sourceId":"wf:C38","targetDetailPath":"/data/v1/records/uc-uc-config-10-921518b8.json","targetId":"uc:UC-CONFIG-10","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dea7699380c1dafca18784059ac4d3587cbcf7b1a11953320aea6345e2334f98","properties":{},"sourceDetailPath":"/data/v1/records/wf-d55-248b03a5.json","sourceId":"wf:D55","targetDetailPath":"/data/v1/records/uc-uc-config-10-921518b8.json","targetId":"uc:UC-CONFIG-10","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:df6142aa63df8aa8ba181a11db36e15410d23acf9d7fccf84d21a93362392c53","properties":{"rationale":"Mapping where information and processing components reside surfaces data on unauthorized or misconfigured systems for remediation; it enables but is not the hardening defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-10-921518b8.json","sourceId":"uc:UC-CONFIG-10","targetDetailPath":"/data/v1/records/risk-config-internet-exposed-misconfig-61b3613a.json","targetId":"risk:config-internet-exposed-misconfig","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ea1b980897a777116c3098d0194286ba0cde17897a5d5f2a87b17be62505098b","properties":{},"sourceDetailPath":"/data/v1/records/wf-c9-75fb1752.json","sourceId":"wf:C9","targetDetailPath":"/data/v1/records/uc-uc-config-10-921518b8.json","targetId":"uc:UC-CONFIG-10","type":"tests"}],"schemaVersion":1}