Asset Security · Topic 3 of 3
Data Security Controls and Compliance
Protecting data at rest, in transit and in use, scoping and tailoring baselines, selecting standards, and using DRM, DLP and CASB to protect data.
- 3 min
- Protect data at rest, in transit and in use.
- Baseline, then scope (which controls apply) and tailor (adjust them).
- Pick standards by data type and obligations.
What it is
Once data is classified, controls must protect it in every state and meet the compliance requirements that apply. Architects select a baseline of controls, scope and tailor it to the environment, and use data-centric tools that protect information wherever it goes.
How it works
Data states
| State | Meaning | Controls |
|---|---|---|
| At rest | Stored on disks, databases, backups | Full-disk and database encryption, access control, key management |
| In transit | Moving across networks | TLS, VPNs, IPsec, secure file transfer |
| In use | Being processed in memory | Access control, memory protection, confidential computing (trusted execution environments) |
Scoping and tailoring
| Term | Meaning |
|---|---|
| Baseline | A starting set of controls for a level of sensitivity |
| Scoping | Selecting which baseline controls apply to this system |
| Tailoring | Adjusting the chosen controls to fit the mission and environment, including compensating controls |
A control removed during scoping must have a documented reason. Removing a requirement because it is inconvenient is not tailoring; it is accepting risk without a decision.
Standards selection
Choose standards based on legal and contractual obligations and the type of data: for example PCI DSS for card data, HIPAA safeguards for US health data, ISO/IEC 27001 for an overall management system, NIST SP 800-53 for detailed controls.
Data protection methods
| Method | What it does |
|---|---|
| Digital rights management (DRM) | Controls what recipients can do with content (view, print, copy, forward), even after it leaves the organization |
| Data loss prevention (DLP) | Detects and blocks sensitive data leaving through email, web, endpoints or cloud, often using labels and content inspection |
| Cloud access security broker (CASB) | Gives visibility and control over cloud service use: shadow IT discovery, policy enforcement, DLP for cloud apps |
| Encryption and tokenization | Make data unreadable or replace it with tokens; tokenization can reduce the number of systems in scope for card data |
| Masking | Hides parts of data from users who do not need full values |
| Anonymization and pseudonymization | Remove or replace identifiers; pseudonymized data can be re-identified with a key, anonymized data should not be |
DLP works best when data is labeled. Without classification, DLP rules are guesses and generate noise.
Non-production data
Test and development environments should not use real sensitive data. Use masked or synthetic data, especially when contractors or wider teams have access.
Compliance verification
Map controls to each requirement, collect evidence, and test regularly. Compliance is a minimum: meeting a standard does not guarantee security.
How the exam asks about this
- "Contractors need realistic test data." Masked copies.
- "Control the copying and forwarding of sensitive documents sent to partners." DRM.
- "Find which cloud services employees use without approval." CASB.
What to remember for the exam
- Protect data at rest, in transit and in use.
- Baseline, then scope (which controls apply) and tailor (adjust them).
- Pick standards by data type and obligations.
- DRM controls use after sharing; DLP stops leaks; CASB governs cloud use.
- Mask or synthesize data outside production.
Pseudonymized data is still personal data under many privacy laws, because it can be re-identified.
Common mistakes
Scoping out a control without a documented reason.
Using real customer data in test environments.
Confusing DLP with DRM.
Check yourself
What is the difference between scoping and tailoring?
Scoping selects which baseline controls apply; tailoring adjusts the selected controls to the environment.
Which tool discovers unsanctioned cloud services in use?
A cloud access security broker (CASB).
Which data state does confidential computing protect?
Data in use.
Topic 3 of 3 in Asset Security
Test yourself on Asset Security
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.