V14.1.1 Sensitive Data Classification and Protection Levels
Verify that all sensitive data created and processed by the application has been identified and classified into protection levels. This includes data that is only encoded and therefore easily decoded, such as Base64 strings or the plaintext payload inside a JWT. Protection levels need to take into account any data protection and privacy regulations and standards which the application is required to comply with. This requirement applies to Level 2.
V14.1.2 Documented Sensitive Data Protection Requirements
Verify that all sensitive data protection levels have a documented set of protection requirements. This must include (but not be limited to) requirements related to general encryption, integrity verification, retention, how the data is to be logged, access controls around sensitive data in logs, database-level encryption, privacy and privacy-enhancing technologies to be used, and other confidentiality requirements. This requirement applies to Level 2.
V14.2.1 Sensitive Data in HTTP Messages
Verify that sensitive data is only sent to the server in the HTTP message body or header fields, and that the URL and query string do not contain sensitive information, such as an API key or session token. This requirement applies to Level 1.
V14.2.2 Prevent Sensitive Data Caching in Server Components
Verify that the application prevents sensitive data from being cached in server components, such as load balancers and application caches, or ensures that the data is securely purged after use. This requirement applies to Level 2.
V14.2.3 Prevent Sending Sensitive Data to Untrusted Parties
Verify that defined sensitive data is not sent to untrusted parties (e.g., user trackers) to prevent unwanted collection of data outside of the application's control. This requirement applies to Level 2.
V14.2.4 Implement Documented Sensitive Data Controls
Verify that controls around sensitive data related to encryption, integrity verification, retention, how the data is to be logged, access controls around sensitive data in logs, privacy and privacy-enhancing technologies, are implemented as defined in the documentation for the specific data's protection level. This requirement applies to Level 2.
V14.2.5 Configure Caching to Prevent Web Cache Deception
Verify that caching mechanisms are configured to only cache responses which have the expected content type for that resource and do not contain sensitive, dynamic content. The web server should return a 404 or 302 response when a non-existent file is accessed rather than returning a different, valid file. This should prevent Web Cache Deception attacks. This requirement applies to Level 3.
V14.2.6 Return Minimum Required Sensitive Data
Verify that the application only returns the minimum required sensitive data for the application's functionality. For example, only returning some of the digits of a credit card number and not the full number. If the complete data is required, it should be masked in the user interface unless the user specifically views it. This requirement applies to Level 3.
V14.2.7 Sensitive Data Retention Classification
Verify that sensitive information is subject to data retention classification, ensuring that outdated or unnecessary data is deleted automatically, on a defined schedule, or as the situation requires. This requirement applies to Level 3.
V14.2.8 Remove Sensitive Information from File Metadata
Verify that sensitive information is removed from the metadata of user-submitted files unless storage is consented to by the user. This requirement applies to Level 3.
V14.3.1 Clear Authenticated Data from Client Storage
Verify that authenticated data is cleared from client storage, such as the browser DOM, after the client or session is terminated. The 'Clear-Site-Data' HTTP response header field may be able to help with this but the client-side should also be able to clear up if the server connection is not available when the session is terminated. This requirement applies to Level 1.
V14.3.2 Anti-Caching HTTP Response Headers for Sensitive Data
Verify that the application sets sufficient anti-caching HTTP response header fields (i.e., Cache-Control: no-store) so that sensitive data is not cached in browsers. This requirement applies to Level 2.
V14.3.3 No Sensitive Data in Browser Storage
Verify that data stored in browser storage (such as localStorage, sessionStorage, IndexedDB, or cookies) does not contain sensitive data, with the exception of session tokens. This requirement applies to Level 2.