Verification of conformity

Prove that you have protected the right data in the right way

Challenges

Additional data privacy laws in the US, Europe, and other international jurisdictions have been enacted and are currently being enforced. CISOs and Data Governance teams responsible for protecting sensitive data must also demonstrate they have protected this data in the right places and in the right way.

 

Data Loss Prevention (DLP) systems and Data masking software can detect and de-identify personally identifiable information (PII). How well do you document your procedures? How easy is it to find and modify specific protection functions when something needs to be remade or done differently? How can the risk of re-identification based on quasi-identifying data be measured and mitigated? And even the best data masking tools for complying with one privacy law are not necessarily the best solution for another law.

Solutions

For recognition control, check the field-level protection functions in the self-documenting, human-readable job scripts of the software products. IRI FieldShield and IRI CoSort (SortCLor the data management platform IRI Voracity provided.

For verification purposes, log all jobs in the query-ready XML audit file. The audit trail contains the job script showing the protection technique(s) applied to each field in each processed table or file. For FieldShield jobs, the audit trail contains the complete contents of the script as well as the regulated and unregulated components contained within it. For more information on Operational Governance System (OGS) infrastructure for these jobs can be found in this article; additionally, there is an integrated log-wrangling tool that allows you to query and export compliance- and performance-related information from the logs. The log also contains other job metadata, such as:

  • used protected library function(s)
  • Encryption codes or de-identification codes
  • Input and output tables or files
  • User who executed the job as well as the applicable policy file
  • Order start and end times
  • Number of records processed per phase, in total, and per second

For prevention control, you can check your orders to verify the protection of output fields by a developer before execution.

For instance, masking the SSN field in a payroll feed is a matter of connecting to your sources (or existing orders) and clicking through a new order wizard, or modifying existing parameters in a dialog or script. Some of the functions you can apply (ad hoc or usually) include:

  • Encryption and decryption
  • Anonymization through pseudonymization
  • Data obfuscation (blurring), hashing, deletion, or scrambling
  • De-Identification and Re-Identification Using Twiddling
  • Field Editing

As a Compliance Officer, you see the safeguards in every self-documenting job script. Upon approval, the job can be saved or executed on a local or remote server using the IRI program.

After execution, the order script can be isolated and protected for reuse in production.

FieldShield also includes a re-identification risk scoring module that statistically measures the likelihood that a data record can be attributed to an individual based on the unprotected quasi-identifying (demographic) attributes. Additional anonymization techniques, such as blurring and bucketing, which reduce the risk of re-identification while maintaining the utility of the data for research and marketing purposes, are also included.

At IRI DarkShield a comprehensive set of dashboard charts is generated, showing which data was found (and masked, if applicable) in structured, semi-structured, and unstructured sources. One of these charts is a bubble chart that allows you to rank the PII risk in each data source—a kind of instant vulnerability analysis (heatmap) resulting from aggregated data discovery (search) jobs.

These data can also be reviewed in machine-readable search and masking artifacts (JSON log files) in the IRI Workbench or exported to SIEM tools such as Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel, Excel, and other SIEM/SOC and log visualization tools for further analysis and response.

At IRI CellShield EE Both the data discovery results and the masking audit trails are provided in Excel and can be linked for export via email, to Splunk, and to Datadog.

Related solutions

Product links

Frequently Asked Questions (FAQ)

Data masking compliance means proving that your company has not only protected sensitive data, but has done so correctly and in accordance with applicable data privacy laws. This includes documenting the data found and masked, as well as providing audit trails of the operations performed.
You provide this proof through audit logs, visual job diagrams, and self-documenting scripts that specify exactly which columns or values were masked and how, who performed the masking, and when it took place. IRI tools such as FieldShield, DarkShield, and CellShield EE provide all of this evidence automatically.
The IRI tools generate machine-readable XML or JSON audit logs as well as visual diagrams. These contain job metadata such as protection methods used, input/output files, job execution details, and applied encryption codes or masking functions.
Using IRI job configuration files (scripts), data class and rule libraries, mapping diagrams, and/or log files, you can see precisely what protection was applied to each data element. Whether redaction, encryption, hashing, or pseudonymization—the methods are clearly defined and configured for easy reuse.
Re-identification risk refers to the probability that masked or unmasked data can be re-associated with an individual using direct or indirect (quasi-)identifiers. IRI FieldShield contains an integrated scoring module that statistically evaluates this risk and helps you initiate further anonymization steps for direct or indirect identifiers.
Yes. The IRI tools are designed to meet requirements from various regulations such as GDPR, HIPAA, FERPA, PCI DSS, and others. Each masking job and audit trail can be adapted to the specific specifications of different laws.
Compliance Officers can use IRI Workbench's data class rule library, data class mapping, job configuration files (scripts), data class mapping dialogs, machine-readable log files, and/or dashboard chart functions to generate and review the results of data classification (PII discovery) and masking jobs. Such job artifacts help auditors understand which protection measures were applied to what data, when, and by whom.
The source-to-target mapping diagram in FieldShield visually represents how data fields were transformed. Orange lines and function symbols show where sensitive data was found and how it was protected.
Yes. Job scripts in the IRI tools are fully reusable and editable. You can isolate, version, or share them across environments using version control tools like EGit to enable smooth deployment and collaboration.
DarkShield can generate dashboard charts that show which data was found and masked in structured, semi-structured, and unstructured sources. It also features a bubble chart for classifying the risk level across various data sources—a kind of quick heatmap for vulnerability assessment.
Audit logs and reports can be exported in machine-readable formats compatible with SIEM tools such as Splunk, Excel, and Datadog. This enables advanced analysis, alerting, or regulatory reporting outside of the IRI environment.
IRI offers specialized tools to meet FERPA and HIPAA requirements. These tools can anonymize student and patient data while maintaining analytic utility—using methods such as bucketing and blurring, among others, to reduce the risk of re-identification while preserving data usability.
Yes. In all IRI tools, data discovery results are linked to masking operations. In CellShield EE, for example, this information is displayed in Excel and can be exported, emailed, or sent to log monitoring systems.
IRI provides exportable, tamper-evident documentation – such as images of data mapping diagrams – for all data protection measures performed. These artifacts help companies respond quickly and credibly to audits, investigations, or information requests.