The application server must attach data tags containing organization-defined authorized processing to organization-defined elements of personally identifiable information.

Data tags support the tracking and enforcement of authorized processing by conveying the types of processing that are authorized along with the relevant elements of personally identifiable information throughout the system. Data tags may also support the use of automated tools.

This requirement also applies to Zero Trust initiatives.

Verify the application server is configured to attach data tags containing organization-defined authorized processing to organization-defined elements of personally identifiable information.

If the application server does not attach data tags containing organization-defined authorized processing to organization-defined elements of personally identifiable information, this is a finding.

Configure the application server to attach data tags containing organization-defined authorized processing to organization-defined elements of personally identifiable information.