# CM-13 — Data Action Mapping

- **Control ID:** CM-13
- **Family:** [CM](/md/families/CM.md)
- **Baselines:** No content available.
- **Enhancement of:** No content available.

## Description

Develop and document a map of system data actions.

## Discussion

Data actions are system operations that process personally identifiable information. The processing of such information encompasses the full information life cycle, which includes collection, generation, transformation, use, disclosure, retention, and disposal. A map of system data actions includes discrete data actions, elements of personally identifiable information being processed in the data actions, system components involved in the data actions, and the owners or operators of the system components. Understanding what personally identifiable information is being processed (e.g., the sensitivity of the personally identifiable information), how personally identifiable information is being processed (e.g., if the data action is visible to the individual or is processed in another part of the system), and by whom (e.g., individuals may have different privacy perceptions based on the entity that is processing the personally identifiable information) provides a number of contextual factors that are important to assessing the degree of privacy risk created by the system. Data maps can be illustrated in different ways, and the level of detail may vary based on the mission and business needs of the organization. The data map may be an overlay of any system design artifact that the organization is using. The development of this map may necessitate coordination between the privacy and security programs regarding the covered data actions and the components that are identified as part of the system.

## Implementation guidance

No content available.

## CSF 2.0 subcategories

- [ID.AM-07](/md/csf/ID.AM-07.md) — Inventories of data and corresponding metadata for designated data types are maintained
- [ID.AM-08](/md/csf/ID.AM-08.md) — Systems, hardware, software, services, and data are managed throughout their life cycles

## Related controls

- [AC-3](/md/controls/AC-3.md)
- [CM-4](/md/controls/CM-4.md)
- [CM-12](/md/controls/CM-12.md)
- [PM-5](/md/controls/PM-5.md)
- [PM-27](/md/controls/PM-27.md)
- [PT-2](/md/controls/PT-2.md)
- [PT-3](/md/controls/PT-3.md)
- [RA-3](/md/controls/RA-3.md)
- [RA-8](/md/controls/RA-8.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.