Context: Data Encryption
Goals: Data classified as Highly Restricted or Restricted must not be exposed to unauthorized parties. When Highly Restricted or Restricted data is stored or transmitted in a manner that may result in exposure, the data must be rendered unreadable to the unauthorized party.
Rationale: Data stewards are obligated to minimize the probability of unintentional exposure of Highly Restricted or Restricted data to unauthorized parties.
Requirement: When data classified as Highly Restricted or Restricted is stored outside of a higher risk network or perimeter, the data will be stored non-readable to Metric. When data classified as Highly Restricted or Restricted is physically or logically transported or transmitted to a higher risk network or perimeter, the data will be rendered non-readable to Metric.
Metric:
Level A:
A1. Data classified as Highly Restricted or Restricted is encrypted to meet requirements in <existing internal standard> when stored, transported or transmitted.
A2. Key recovery for symmetric keys will be implemented to meet requirements in <existing internal standard>.
A3. Credentials, other than UserID, for accounts with privileges sufficient to access or modify IT system data are encrypted to meet requirements in <existing internal standard>.
A4. Credentials, other than UserID, for accounts with privileges sufficient to access or modify IT system configuration are encrypted to meet requirements in <existing internal standard>.
Level B:
B1. Credentials, other than UserID, for accounts with privileges sufficient to modify IT system configuration are encrypted when stored or transmitted.
Level C:
This Level Intentionally Left Blank
Level D:
D1. IT system is implemented in conformance with network segmentation policies/controls implemented to meet requirements defined in ISO 27002, section 13.1.3
D2. Logical and physical security perimeters are identified and documented
D3. Data classified as Highly Restricted or Restricted stored, transported or transmitted to a higher risk network or perimeter is encrypted
Scale:
Transport Encryption: <existing internal standard>
Storage Encryption: <existing internal standard>
Key Recovery: <existing internal standard>
Stakeholders: Data owners, System Managers, Operations
Implications: If this requirement is not met, the appropriate security controls may not be implemented to protect the data from unauthorized access or improper data exposure.
Applicability: See Enterprise Requirements Framework
Tags: Security, Data Encryption
Status: Approved, Requirement
Author: <Author>
Revision: <Revision>
Note:
Incorporates the traditional concepts of protecting data using encryption such that the data is only readable by authorized individuals.
The intent of this requirement is to ensure transport layer security is implemented for data that is transmitted over a less trusted network, and that encryption is implemented for data at rest. Encryption of data at rest may include full disk encryption, database encryption, and/or encryption of backup media.
For more information, see NFR Summary
