Translated from 日本語 • View original 
"8.10 Deletion of Information"
"Information stored in information systems, devices, or other storage media must be deleted when it is no longer needed."
It's not a particularly new item, but retaining unnecessary information increases the risk of leakage. It is often said that the deletion certificate when disposing of a PC is required, but it is necessary to delete information on SaaS and unnecessary information.
Our SaaS and software are managed by "Colorkrew Workflows" as important assets, so we prevent deletion omissions by regularly reviewing them.
Also, when using Microsoft Entra ID, we hear more often than customers say that too many "enterprise applications" are created to manage.
"Enterprise applications" can not only use SaaS applications, but also browse and update the user directory of Entra ID, so if unnecessary applications are left unattended, the risk of information leakage increases (such as the PC being infected with malware and the secrets stored can be exploited).
In that case, you can use the Azure AD portal recommendation "Delete unused applications" to detect applications that haven't been used for more than 90 days.
Delete the detected application without question, or notify the owner to take action.
"8.11 Data Masking"
"Data masking must be used in accordance with the organization's topic-specific and other relevant topic-specific policies on access control, as well as business requirements, taking into account applicable laws and regulations."
It is the same as pseudonymously processed information and anonymously processed information under the Personal Information Protection Act.
If there is applicable data, we will establish and operate it with implementation regulations such as data encryption and access control.
"8.12 Data Leak Prevention"
"Data leakage prevention measures must be applied to systems, networks, and other devices that process, store, or transmit information that requires careful handling."
While there are many security measures for the data we cover, we mentioned monitoring the activity of retirees in this review.
If you're a Microsoft 365 E5 customer, you can set it up in Purview Insider Risk Management.
Evaluation During Screening
There was no problem by submitting the above application, approval, and deletion performance data and actual operation status as evidence.
What data will be used for these controls? What are the risks? What measures are you taking to deal with that risk? and by being able to submit evidence immediately, the review process can proceed smoothly.
We have introduced up to 8 of the 11 management measures. It's the last time next time.