All personal and sensitive data held by the company is formally required to be identified and recorded
Knowing where personal and sensitive data lives is a precondition for classifying it correctly, making the data inventory a foundation A.5.12's classification scheme depends on.
Requiring that all personal and sensitive data be identified, located and owned gives a privacy program the starting inventory this control depends on.
This policy control requires all personal and sensitive data to be identified and recorded with location and owner, covering the data slice of A.5.9's asset inventory.