Control A.8.11: Data Masking

Status: Not Applicable

Justification:

This control is not applicable because anDREa does not utilize or extract data derived from the production environment for non-production purposes, such as testing, development, or training. Non-production and staging environments are populated exclusively with synthetic or mock data rather than altered or masked production datasets. Because live production data is strictly confined to the production environment and access is governed by production identity and access management (IAM) controls, the operational requirement to implement data masking techniques or anonymization pipelines falls outside the entity's current operational framework.