Automated reads must select only the columns they require

Control Statement: A business process element that reads records must specify the columns it requires rather than selecting all of them.

Description: Creatio’s read-data process element allows the set of columns to read to be left unspecified, in which case every column of the record is selected. This control requires that processes reading records holding personal or sensitive data specify the columns they need.

Rationale: An unspecified column list makes a process’s data footprint implicit and unstable. What it reads is determined by the object’s current shape, so a column added later — including a sensitive one added by someone with no knowledge of this process — is silently drawn into every subsequent execution. Where the process writes to a log, sends a notification, or passes the record to an integration, that column travels with it. The failure is therefore introduced by a change made elsewhere, at a time when nobody is examining this process, which is why it is not caught by review of the change that causes it.

Audit Procedure:

1. Enumerate the business processes containing read-data elements.
2. For each such element, determine whether the set of columns to read is specified.
3. Record as non-compliant every element with an unspecified column list that reads an object identified under CSB-DATA-001 as holding personal or sensitive data.
4. For each, determine where the resulting data is subsequently written or transmitted.

Remediation:

1. For each non-compliant element, identify the columns the process actually uses downstream.
2. Specify those columns explicitly on the element.
3. Verify the process still functions, since downstream elements may reference columns the read was silently supplying.
4. Prefer specifying columns on all read elements, not only those reading sensitive objects, so the control does not depend on the classification remaining current.

Default Value: Creatio leaves the column list of a read-data element unspecified by default, which selects all columns. No warning is shown, and the resulting column set is not recorded anywhere in the process definition.