Protection of Information at Rest SC-28

Source: NIST SP 800-53 Rev.5, System and Communications Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SC-28 (Protection of Information at Rest) requires protecting the confidentiality and/or integrity of information while it is stored — typically through encryption of disks, files, or databases, plus integrity checks on stored data. At Moderate it applies to the stored information the system is responsible for.

What good looks like

• Encrypt data at rest — full-disk encryption, or file/database-level encryption for sensitive data.
• Protect the integrity of stored data so unauthorized changes are detected.
• Manage the keys that protect at-rest data separately from the data itself (ties to SC-12).
• Apply the protection to backups and snapshots, not just the live volume.

Framework mapping

• NIST CSF 2.0 — PR.DS-01 — The confidentiality and integrity of data-at-rest are protected
• CIS Controls v8 — Control 3.11 — Encrypt sensitive data at rest

How to move it toward Implemented

• The integrity half is covered: AIDE (Advanced Intrusion Detection Environment) baselines files at rest and caught a planted canary.
• The missing half is confidentiality — there is no encryption at rest. Plan full-disk encryption using the Linux Unified Key Setup (LUKS) at the next rebuild, or at minimum encrypt the sensitive data directory, and manage the key per SC-12.
• Once encryption is in place, capture lsblk and cryptsetup status as evidence naming SC-28 to move from partial toward 'Completed'.