SC-28 — Protection of Information at Rest

Official NIST control content

Control statement

Protect the [Organization-defined: sc-28_odp.01] of the following information at rest: [Organization-defined: information at rest].

Official NIST discussion

Discussion

Information at rest refers to the state of information when it is not in process or in transit and is located on system components. Such components include internal or external hard disk drives, storage area network devices, or databases. However, the focus of protecting information at rest is not on the type of storage device or frequency of access but rather on the state of the information. Information at rest addresses the confidentiality and integrity of information and covers user information and system information. System-related information that requires protection includes configurations or rule sets for firewalls, intrusion detection and prevention systems, filtering routers, and authentication information. Organizations may employ different mechanisms to achieve confidentiality and integrity protections, including the use of cryptographic mechanisms and file share scanning. Integrity protection can be achieved, for example, by implementing write-once-read-many (WORM) technologies. When adequate protection of information at rest cannot otherwise be achieved, organizations may employ other controls, including frequent scanning to identify malicious code at rest and secure offline storage in lieu of online storage.

Official OSCAL parameters

Organization-defined parameters

These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.

sc-28_odp.01

information at restinformation at rest requiring protection is defined;

Original Bare Metal Cyber perspective

From control text to operational evidence

Use Protection of Information at Rest as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to secure architecture, boundary protection, communications protection, cryptography, and system isolation.

Implementation workflow

Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
Resolve each organization-defined parameter before declaring the control implemented.
Document how the implementation satisfies every clause of the official control statement.
Collect evidence as a normal byproduct of operation rather than only before an assessment.
Review exceptions, changes, and monitoring results on a risk-based cadence.

Evidence examples

network and trust-boundary diagrams
firewall and gateway configurations
cryptographic configuration and key records
segmentation and isolation test results

Common failure patterns

diagrams omit cloud and third-party paths
encryption enabled without key governance
flat trust zones allow unnecessary lateral movement
boundary rules accumulate without owner review

Questions practitioners should ask

What risk decision is this control intended to support in this system?
Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
What event or threshold requires the implementation to be reviewed or changed?

Official NIST SP 800-53A content

Assessment objectives and methods

Show the assessment objective

the [Organization-defined: sc-28_odp.01] of [Organization-defined: information at rest] is/are protected.

Examine

System and communications protection policy
procedures addressing the protection of information at rest
system design documentation
system configuration settings and associated documentation
cryptographic mechanisms and associated configuration documentation
list of information at rest requiring confidentiality and integrity protections
system security plan
other relevant documents or records

Interview

System/network administrators
organizational personnel with information security responsibilities
system developer

Test

Mechanisms supporting and/or implementing confidentiality and integrity protections for information at rest

Official relationships

Related controls

These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.

Official NIST enhancements

Control enhancements

Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.

Official NIST control enhancement

SC-28(1) — Cryptographic Protection

ModerateHigh

Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on [Organization-defined: system components or media]: [Organization-defined: information].

Official discussion

The selection of cryptographic mechanisms is based on the need to protect the confidentiality and integrity of organizational information. The strength of mechanism is commensurate with the security category or classification of the information. Organizations have the flexibility to encrypt information on system components or media or encrypt data structures, including files, records, or fields.

Organization-defined parameters (2)

informationinformation requiring cryptographic protection is defined;

system components or mediasystem components or media requiring cryptographic protection is/are defined;

Assessment objectives and methods

SC-28(01)[01]cryptographic mechanisms are implemented to prevent unauthorized disclosure of [Organization-defined: information] at rest on [Organization-defined: system components or media];
SC-28(01)[02]cryptographic mechanisms are implemented to prevent unauthorized modification of [Organization-defined: information] at rest on [Organization-defined: system components or media].

Examine

System and communications protection policy
procedures addressing the protection of information at rest
system design documentation
system configuration settings and associated documentation
cryptographic mechanisms and associated configuration documentation
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
organizational personnel with information security responsibilities
system developer

Test

Cryptographic mechanisms implementing confidentiality and integrity protections for information at rest

Related controls

Official NIST control enhancement

SC-28(2) — Offline Storage

Remove the following information from online storage and store offline in a secure location: [Organization-defined: information].

Official discussion

Removing organizational information from online storage to offline storage eliminates the possibility of individuals gaining unauthorized access to the information through a network. Therefore, organizations may choose to move information to offline storage in lieu of protecting such information in online storage.

Organization-defined parameters (1)

informationinformation to be removed from online storage and stored offline in a secure location is defined;

Assessment objectives and methods

SC-28(02)[01][Organization-defined: information] is removed from online storage;
SC-28(02)[02][Organization-defined: information] is stored offline in a secure location.

Examine

System and communications protection policy
procedures addressing the protection of information at rest
system design documentation
system configuration settings and associated documentation
cryptographic mechanisms and associated configuration documentation
offline storage locations for information at rest
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
organizational personnel with information security responsibilities

Test

Mechanisms supporting and/or implementing the removal of information from online storage
mechanisms supporting and/or implementing storage of information offline

Official NIST control enhancement

SC-28(3) — Cryptographic Keys

Provide protected storage for cryptographic keys [Organization-defined: sc-28.03_odp.01].

Official discussion

A Trusted Platform Module (TPM) is an example of a hardware-protected data store that can be used to protect cryptographic keys.

Organization-defined parameters (2)

sc-28.03_odp.01

safeguardssafeguards for protecting the storage of cryptographic keys are defined (if selected);

Assessment objectives and methods

protected storage for cryptographic keys is provided using [Organization-defined: sc-28.03_odp.01].

Examine

System and communications protection policy
procedures addressing the protection of information at rest
system design documentation
system configuration settings and associated documentation
cryptographic mechanisms and associated configuration documentation
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
organizational personnel with information security responsibilities

Test

Mechanisms supporting and/or implementing hardware-based key store protection

Related controls

Source record

Authoritative sources

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.