PR.DS Data Security

Statement

The confidentiality, integrity, and availability of data-at-rest are protected

Guidance

Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of stored data in files, databases, virtual machine disk images, container images, and other resources

Guidance

Use full disk encryption to protect data stored on user endpoints

Guidance

Confirm the integrity of software by validating signatures

Guidance

Restrict the use of removable media to prevent data exfiltration

Guidance

Physically secure removable media containing unencrypted sensitive information, such as within locked offices or file cabinets

Statement

The confidentiality, integrity, and availability of data-in-transit are protected

Guidance

Use encryption, digital signatures, and cryptographic hashes to protect the confidentiality and integrity of network communications

Guidance

Automatically encrypt or block outbound emails and other communications that contain sensitive data, depending on the data classification

Guidance

Block access to personal email, file sharing, file storage services, and other personal communications applications and services from organizational systems and networks

Guidance

Prevent reuse of sensitive data from production environments (e.g., customer records) in development, testing, and other non-production environments

Statement

Assets are formally managed throughout removal, transfers, and disposition

Statement

Adequate capacity to ensure availability is maintained

Statement

Protections against data leaks are implemented

Statement

Integrity checking mechanisms are used to verify software, firmware, and information integrity

Statement

The development and testing environment(s) are separate from the production environment

Statement

Integrity checking mechanisms are used to verify hardware integrity

Statement

The confidentiality, integrity, and availability of data-in-use are protected

Guidance

Remove data that must remain confidential (e.g., from processors and memory) as soon as it is no longer needed

Guidance

Protect data in use from access by other users and processes of the same platform

Statement

Backups of data are created, protected, maintained, and tested

Guidance

Continuously back up critical data in near-real-time, and back up other data frequently at agreed-upon schedules

Guidance

Test backups and restores for all types of data sources at least annually

Guidance

Securely store some backups offline and offsite so that an incident or disaster will not damage them

Guidance

Enforce geographic separation and geolocation restrictions for data backup storage