SC-28 Protection of Information at Rest

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Moderate, High	System	3 (1 in a baseline)

Related controls: AC-3, AC-4, AC-6, AC-19, CA-7, CM-3, CM-5, CM-6, CP-9, MP-4, MP-5, PE-3, SC-8, SC-12, SC-13, SC-34, SI-3, SI-7, SI-16

Control statement

Protect the [Selection (one or more): confidentiality; integrity] of the following information at rest: [Assignment: organization-defined information at rest].

NIST discussion

Information at rest refers to the state of information when it is not in process or in transit and is located on system components. Such components include internal or external hard disk drives, storage area network devices, or databases. However, the focus of protecting information at rest is not on the type of storage device or frequency of access but rather on the state of the information. Information at rest addresses the confidentiality and integrity of information and covers user information and system information. System-related information that requires protection includes configurations or rule sets for firewalls, intrusion detection and prevention systems, filtering routers, and authentication information. Organizations may employ different mechanisms to achieve confidentiality and integrity protections, including the use of cryptographic mechanisms and file share scanning. Integrity protection can be achieved, for example, by implementing write-once-read-many (WORM) technologies. When adequate protection of information at rest cannot otherwise be achieved, organizations may employ other controls, including frequent scanning to identify malicious code at rest and secure offline storage in lieu of online storage.

Control enhancements

SC-28(1) Cryptographic Protection

Baselines: Moderate, High

Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on [Assignment: organization-defined system components or media]: [Assignment: organization-defined information].

Discussion and assessment objectives for SC-28(1)

The selection of cryptographic mechanisms is based on the need to protect the confidentiality and integrity of organizational information. The strength of mechanism is commensurate with the security category or classification of the information. Organizations have the flexibility to encrypt information on system components or media or encrypt data structures, including files, records, or fields.

Determine if:

SC-28(01)[01] cryptographic mechanisms are implemented to prevent unauthorized disclosure of [Assignment: organization-defined information] at rest on [Assignment: organization-defined system components or media];
SC-28(01)[02] cryptographic mechanisms are implemented to prevent unauthorized modification of [Assignment: organization-defined information] at rest on [Assignment: organization-defined system components or media].

Examine: System and communications protection policy; procedures addressing the protection of information at rest; system design documentation; system configuration settings and associated documentation; cryptographic mechanisms and associated configuration documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developer.

Test: Cryptographic mechanisms implementing confidentiality and integrity protections for information at rest.

SC-28(2) Offline Storage

Baselines: Not in a baseline

Remove the following information from online storage and store offline in a secure location: [Assignment: organization-defined information].

Discussion and assessment objectives for SC-28(2)

Removing organizational information from online storage to offline storage eliminates the possibility of individuals gaining unauthorized access to the information through a network. Therefore, organizations may choose to move information to offline storage in lieu of protecting such information in online storage.

Determine if:

SC-28(02)[01] [Assignment: organization-defined information] is removed from online storage;
SC-28(02)[02] [Assignment: organization-defined information] is stored offline in a secure location.

Examine: System and communications protection policy; procedures addressing the protection of information at rest; system design documentation; system configuration settings and associated documentation; cryptographic mechanisms and associated configuration documentation; offline storage locations for information at rest; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing the removal of information from online storage; mechanisms supporting and/or implementing storage of information offline.

SC-28(3) Cryptographic Keys

Baselines: Not in a baseline

Provide protected storage for cryptographic keys [Selection: [Assignment: organization-defined safeguards] ; hardware-protected key store].

Discussion and assessment objectives for SC-28(3)

A Trusted Platform Module (TPM) is an example of a hardware-protected data store that can be used to protect cryptographic keys.

Determine if protected storage for cryptographic keys is provided using [Selection: [Assignment: organization-defined safeguards] ; hardware-protected key store].

Interview: System/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms supporting and/or implementing hardware-based key store protection.

Assessment objectives (SP 800-53A)

Objectives and methods for SC-28

Determine if the [Selection (one or more): confidentiality; integrity] of [Assignment: organization-defined information at rest] is/are protected.

Examine: System and communications protection policy; procedures addressing the protection of information at rest; system design documentation; system configuration settings and associated documentation; cryptographic mechanisms and associated configuration documentation; list of information at rest requiring confidentiality and integrity protections; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developer.

Test: Mechanisms supporting and/or implementing confidentiality and integrity protections for information at rest.

Policy statement

The System owner shall ensure the system protects the Select one or more: confidentiality; integrity Typical: confidentiality and integrity of Fill in: information at rest requiring protection Typical: all information stored by the system, including backups. (SC-28)

SC-28(1) Cryptographic protection

The System owner shall implement cryptographic mechanisms to prevent unauthorized disclosure and modification of Fill in: information requiring cryptographic protection Typical: all organizational information at rest on Fill in: system components or media requiring cryptographic protection Typical: servers, databases, storage services, backups, end-user devices and removable media. (SC-28(1))

From the System and Communications Protection Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

SC-28 asks you to protect stored information: on servers, in databases, in storage services, in backups and on end-user devices. At Moderate and High, SC-28(1) makes the protection cryptographic, using the cryptography chosen under SC-13. Encryption at rest protects against lost devices, stolen media and direct access to storage; it does not protect against someone who can sign in to the application.

Common implementations. Full-disk encryption on laptops and mobile devices, managed centrally with recovery keys held by the organization. Encryption enabled by default on cloud storage, block volumes and managed databases, with keys held in a cloud key management service or hardware security module and customer-managed keys for sensitive data. Transparent database encryption, and field-level encryption for the most sensitive values. Encrypted backups, with keys stored apart from the backup data.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
What to protect (SC-28)	Confidentiality and integrity
Information at rest to protect (SC-28)	All information stored by the system, including backups
Components or media where cryptography is required (SC-28(1))	Servers, databases, storage services, backups, end-user devices and removable media
Information to encrypt (SC-28(1))	All organizational information

Evidence assessors ask for.

A storage inventory showing encryption status for each store, drawn against the component inventory
Cloud policy or configuration showing encryption enforced by default
Endpoint management reports showing device encryption status
Key management records: who can use and administer each key

Inheritance. Cloud providers encrypt their storage by default, and endpoint encryption is usually an enterprise service. The system owns its database and application-level encryption and confirms that every store it uses is covered.

Common findings.

Backups, snapshots or exports left unencrypted while the primary store is encrypted.
Encryption keys held in the same place as the data, or available to every administrator.
Devices missing from the encryption compliance report.
Log files and temporary files holding sensitive data without protection.

Enhancements in the Moderate baseline. SC-28(1) cryptographic protection, also in High.

Artifacts

Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.