SC-28 Protection of information at rest
Requires the confidentiality or integrity, as the organization determines, of organization-defined information at rest to be protected, so that stored information is safeguarded independently of the access controls in fr
4
artefacts
2
held by a system
0
at each review
easy
to go live
Backup / DR tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Encryption configuration for storage, databases and backups · Backup / DR tooling
- Verification evidence such as storage configuration reports · Cloud console / configuration management
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Definition of the information at rest in scope and whether confidentiality, integrity or both are protected · Policy repository / GRC workspace
- Key management arrangements supporting the protection · Policy repository / GRC workspace
First move
Automate the pull from your Backup / DR tooling. Backup job success history and restore-test logs from the backup platform.
Common gaps auditors find
- Primary storage encrypted while backups, exports and logs are not
- Encryption keys held beside the data they protect
- Scope never defined, so protection is applied inconsistently across data stores
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-27 Platform-independent Applications. Include within organizational systems the following platform independent applications: [organization-defined] · SC-29 Heterogeneity. Employ a diverse set of information technologies for the following system components in the implementation of the system: [organization-defined]