Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.

NIST CSF Category profileIntermediate

Data Security (PR.DS) — NIST CSF 2.0 Category

Use PR.DS to manage data at rest, in transit, and in use, plus protected and tested backups within the Protect Function.

Framework mapping

NIST Cybersecurity Framework 2.0

CSF 2.0
CategoryPR.DS — Data Security
FunctionPR — ProtectCategoryPR.DS — Data Security
Official CSF Core outcome

Data are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.

CSF outcomes describe what an organization may seek to achieve. They do not prescribe one implementation or turn the Core into a universal checklist.

Category outcome

NIST CSF 2.0 places Data Security (PR.DS) within the Protect Function. The official Category outcome is: “Data are managed consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information.”

This Category provides a structured way to address data at rest, in transit, and in use, plus protected and tested backups. It groups related Subcategory outcomes without prescribing a specific technology, organizational model, or implementation sequence.

What this means in practice

A credible Data Security capability connects policy and risk decisions to repeatable operating practices. The organization should define scope, ownership, expected outcomes, evidence, exceptions, and reassessment triggers.

Implementation should be proportionate to mission needs, legal and contractual obligations, threat exposure, business impact, and the organization’s risk appetite. The same Category may be implemented differently across systems and business contexts.

Implementation priorities

The following priorities translate the Category into an operating capability. They are starting points for design and governance, not a replacement for architecture, procedures, or risk analysis.

  • Classify data and identify owners, repositories, flows, users, and retention requirements.
  • Apply protection appropriate to data sensitivity, state, location, and business need.
  • Manage cryptographic keys, access, integrity, and secure processing environments.
  • Create isolated, protected, and recoverable backups for critical data.
  • Monitor access, transfer, modification, deletion, and restoration activities.

Evidence and measurement

Evidence should show that the Category’s outcomes are achieved in the intended scope, remain effective, and are reviewed when conditions change. A policy, tool purchase, or completed checklist is not sufficient by itself.

  • Data inventories, classifications, and flow maps
  • Encryption, key-management, and access-control configuration
  • Integrity and secure-processing controls
  • Backup configuration, immutability, and restoration tests
  • Data access, movement, and loss-prevention telemetry

Subcategories within PR.DS

This Category contains 4 CSF 2.0 Subcategory outcomes. Each outcome has a dedicated Bare Metal Cyber profile with the official NIST statement and original implementation guidance.

  • PR.DS-01 — Protect Data at Rest: The confidentiality, integrity, and availability of data-at-rest are protected
  • PR.DS-02 — Protect Data in Transit: The confidentiality, integrity, and availability of data-in-transit are protected
  • PR.DS-10 — Protect Data in Use: The confidentiality, integrity, and availability of data-in-use are protected
  • PR.DS-11 — Create, Protect, Maintain, and Test Backups: Backups of data are created, protected, maintained, and tested

Using this Category in Current and Target Profiles

For a Current Profile, record which Subcategory outcomes are achieved, the scope of the assessment, and the evidence supporting the judgment. For a Target Profile, select the outcomes needed to meet risk management objectives and describe the target conditions.

Prioritize the resulting gaps by mission consequence, risk exposure, dependencies, obligations, implementation effort, and the value of the improvement. Record the owner and the evidence that will demonstrate closure.

Common failure modes

The following conditions can create the appearance of coverage without reliable outcome achievement. Treat them as hypotheses to test during assessments, exercises, and operational reviews.

  • Protection is applied to stored data but not transfer or processing paths.
  • Keys and privileged data access share the same administrative boundary.
  • Backups are successful but not isolated or restored in realistic tests.
  • Data inventories omit SaaS, endpoints, analytics copies, or sensitive metadata.

Source, scope, and attribution

The Category identifier, name, description, and Subcategory outcomes are from NIST CSWP 29. Bare Metal Cyber’s implementation, evidence, failure-mode, and Profile guidance is original educational material.

The CSF describes outcomes, not mandatory implementation steps. Use NIST’s current online Implementation Examples and Informative References when selecting practices and controls for a specific environment.

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

NIST CSF 2.0CompTIA Security+ISC2 CISSPGIAC GSEC

Authoritative sources