Data Security Authority - Data Protection and Security Reference

Data security and data protection sit at the intersection of technical controls, legal obligation, and organizational risk management across every sector of the US economy. This page defines the scope of data security as a discipline, explains how protective frameworks operate mechanically, maps the regulatory landscape enforced by named federal and state agencies, and identifies decision boundaries that separate overlapping security domains. The reference draws on published standards from NIST, CISA, and sector-specific regulators to provide a consistent definitional baseline for practitioners, policymakers, and researchers.

Definition and scope

Data security encompasses the policies, technical controls, and procedural safeguards that protect digital information from unauthorized access, disclosure, modification, destruction, or exfiltration throughout its full lifecycle — from creation and storage through transmission and disposal. The scope extends beyond cybersecurity in the narrow sense: it includes physical media controls, access governance, cryptographic integrity, and regulatory compliance obligations imposed by statute.

The National Cybersecurity Authority reference network, accessible from the site index, organizes this discipline into distinct verticals. The foundational taxonomy begins at cybersecurity terminology and definitions, which disambiguates terms that regulators and vendors use inconsistently.

Three primary classification axes define the field:

1. Data state — data at rest (stored), data in transit (transmitted), data in use (processed in memory)
2. Regulatory domain — federal sector mandates (HIPAA, GLBA, FERPA) vs. state privacy statutes (CCPA, NY SHIELD Act) vs. cross-border frameworks (EU-US Data Privacy Framework)
3. Control type — preventive (encryption, access control), detective (logging, anomaly detection), corrective (incident response, recovery)

NIST Special Publication 800-53 Revision 5 catalogs 20 control families directly applicable to federal information systems, with Privacy (PT) and Supply Chain Risk Management (SR) families added in the 2020 revision.

The National Data Protection Authority covers the regulatory architecture of US data protection law with particular depth on state-level privacy statutes, while National Privacy Authority addresses the intersection of privacy rights and security obligations under frameworks such as the FTC Act Section 5 and the California Consumer Privacy Act (CCPA, Cal. Civ. Code §1798.100).

How it works

Data security operates through a layered architecture commonly described as defense-in-depth — the principle that no single control is sufficient and that independent protective layers must each be capable of limiting damage if adjacent layers fail. CISA's published guidance on Zero Trust Maturity Model (2023) formalized five pillars: Identity, Devices, Networks, Applications and Workloads, and Data.

A structured breakdown of the operational sequence:

1. Asset inventory and classification — Data assets are cataloged and assigned sensitivity tiers (e.g., Public, Internal, Confidential, Restricted). NIST SP 800-60 provides the classification mapping for federal agencies.
2. Threat modeling — Threat actors, attack vectors, and potential impact are assessed. The MITRE ATT&CK framework (attack.mitre.org) provides a publicly maintained taxonomy of adversary techniques.
3. Control selection and implementation — Controls are selected from frameworks such as NIST CSF 2.0 or CIS Controls v8, which organizes 153 safeguards across 18 control groups.
4. Encryption and key management — Data at rest and in transit are cryptographically protected. Encryption Authority provides detailed reference on cipher standards, key lifecycle management, and compliance requirements under FIPS 140-3.
5. Access governance — Role-based access control (RBAC) and least-privilege principles restrict data exposure. Identity Security Authority and Identity Protection Authority cover the IAM and credential governance dimensions respectively.
6. Monitoring and detection — Security information and event management (SIEM) platforms correlate log data. Cyber Audit Authority covers audit log requirements across major compliance frameworks, and Network Audit Authority addresses packet-level and flow-based detection.
7. Incident response and recovery — A documented IR plan defines containment, eradication, and recovery procedures. Data Recovery Authority covers RTO/RPO planning and backup integrity verification, while Continuity Authority addresses business continuity and disaster recovery planning at the enterprise level.

The how cybersecurity works conceptual overview provides the mechanism-level explanation that underlies all seven phases above.

Common scenarios

Data security controls manifest differently across deployment contexts. Four high-frequency scenarios illustrate where domain-specific guidance applies:

Cloud-hosted data environments — Organizations migrating workloads to IaaS and SaaS platforms face shared-responsibility models where the provider secures infrastructure but the tenant retains responsibility for data classification, access control, and encryption configuration. Cloud Security Authority maps provider-specific shared responsibility boundaries, Cloud Compliance Authority covers regulatory obligations for cloud-stored data under HIPAA and FedRAMP, and Cloud Defense Authority addresses active threat response in cloud environments. For backup integrity specifically, Cloud Backup Authority details immutable backup architectures and 3-2-1 rule implementations.

Application-layer vulnerabilities — The 2023 Verizon Data Breach Investigations Report found that web application attacks accounted for 26% of all breaches analyzed. Application Security Authority covers OWASP Top 10 mitigations and secure development lifecycle (SDLC) integration, while Code Compliance Authority addresses static analysis requirements under federal acquisition regulations. Penetration Testing Authority covers scoped assessment methodologies for identifying exploitable application weaknesses before adversaries reach them.

Ransomware and extortion — Ransomware attacks encrypt or exfiltrate organizational data and demand payment for decryption keys or non-disclosure. The FBI's Internet Crime Complaint Center (IC3) 2023 Internet Crime Report recorded $59.6 million in ransomware-attributed losses from reported incidents. Ransomware Authority covers detection, containment, and recovery-specific procedures drawn from CISA's #StopRansomware advisories.

Endpoint and mobile data exposure — Endpoints — laptops, workstations, mobile devices — represent the most common initial access vector. Endpoint Security Authority covers EDR deployment, device hardening baselines (CIS Benchmarks), and removable media controls. Mobile Security Authority addresses BYOD policy frameworks and mobile device management (MDM) configuration under NIST SP 800-124.

Geographic and sector-specific regulatory exposure — Regulatory obligations vary significantly by state. California Security Authority covers the CCPA/CPRA compliance stack and California AG enforcement patterns; New York Security Authority addresses the NY SHIELD Act and DFS Cybersecurity Regulation (23 NYCRR 500), which requires covered financial entities to maintain a documented cybersecurity program; Florida Security Authority covers Florida's Digital Bill of Rights (CS/HB 9-B) and breach notification requirements; and Texas Security Authority maps obligations under the Texas Data Privacy and Security Act effective July 2024. For metro-level implementation context, Miami Security Authority and Orlando Security Authority address Florida-specific enforcement environments.

Decision boundaries

Practitioners frequently encounter ambiguity at the edges of data security's domain. The following boundaries delineate where adjacent disciplines begin.

Data security vs. information security — Information security (infosec) encompasses both digital and non-digital information assets, including physical documents, verbal disclosures, and intellectual property in analog form. Data security is a subset of infosec focused on digital assets. Information Security Authority covers the broader infosec discipline, while Infosec Authority provides practitioner-oriented reference on certification frameworks (CISSP, CISM) and professional standards.

Data security vs. data privacy — Data security is the technical and procedural control layer; data privacy is the legal and ethical layer governing what data may be collected, processed, and retained about individuals. A system can be technically secure (no unauthorized access) while remaining non-compliant with privacy law (retaining data without consent). The regulatory context for this distinction is explored in the regulatory context for cybersecurity reference.

Data security vs. network security — Network security controls protect transmission channels and perimeter infrastructure; data security controls protect the information assets themselves. Both are necessary