|
controlSC-28
Protection of Information at Rest (SC-28)
Protect the [organization-defined] of the following information at rest: [organization-defined].
Security Baselines
MODERATEHIGHLOW
communicationsencryptionboundary-protectionnetwork
Why These Connect
Maps To3
These are equivalent or closely aligned requirements in other frameworks.
Baselined In2
This control is included in the linked security baseline (LOW, MODERATE, or HIGH).
Supports30
These related controls work together — a change to one may affect the others.
Mitigates2
This control helps defend against or reduce the risk of the linked threat technique.
Enhances3
These enhancements add specific capabilities or refinements to the base control.
Related Controls(20)
AC-3Access Enforcement (AC-3)
LMH
CM-3Configuration Change Control (CM-3)MH
CM-5Access Restrictions for Change (CM-5)LMH
CM-6Configuration Settings (CM-6)LMH
CM-12Information Location (CM-12)MH
MP-4Media Storage (MP-4)MH
MP-5Media Transport (MP-5)MH
PE-3Physical Access Control (PE-3)LMH
SC-8Transmission Confidentiality and Integrity (SC-8)MH
SC-13Cryptographic Protection (SC-13)LMH
AC-4Information Flow Enforcement (AC-4)MH
AC-6Least Privilege (AC-6)MH
AC-19Access Control for Mobile Devices (AC-19)LMH
CA-7Continuous Monitoring (CA-7)LMH
CP-9System Backup (CP-9)LMH
SC-12Cryptographic Key Establishment and Management (SC-12)LMH
SC-34Non-modifiable Executable Programs (SC-34)SI-3Malicious Code Protection (SI-3)LMH
SI-7Software, Firmware, and Information Integrity (SI-7)MH
SI-16Memory Protection (SI-16)MH
Threat Coverage(2 ATT&CK techniques)
Cross-Framework Mappings(3)
PR.DS-01PR.DS-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ISO 27001ISO/IEC 27001:20222 mappingsFinal
NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022
PR.DS-01PR.DS-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
Organization-Defined Parameters(2)
SelectionSelection (one-or-more): confidentiality / integrity
Assignmentorganization-defined information at rest