Data security controls and compliance

Sub-domain 2.6 of the 2024 outline asks you to determine data security controls and compliance requirements. Lesson 7 covered the data states and protection methods. This lesson covers the rest of the sub-domain: how organizations choose control baselines, how they scope and tailor them to fit, how they select standards, and the three data protection technologies the outline names, digital rights management (DRM), data loss prevention (DLP) and cloud access security brokers (CASB). It also looks at compliance: how to show that the controls meet legal, regulatory and contractual requirements.

Baselines

A baseline is a minimum set of security controls for a category of system or data. Baselines save organizations from designing controls from scratch for every system and make protection consistent. They come from frameworks, standards and regulations: the NIST SP 800-53 low, moderate and high baselines, with SP 800-53B describing how they are built; the CIS Critical Security Controls implementation groups; ISO/IEC 27001 Annex A controls applied through a statement of applicability; PCI DSS for payment card environments; and sector or government profiles. Technical configuration baselines, such as CIS Benchmarks, apply the same idea to individual products, as lesson 5 described.

Canadian federal systems use the Canadian Centre for Cyber Security's ITSG-33 IT security risk management guidance, whose control catalogue is derived from NIST SP 800-53, with security control profiles for categories such as Protected B, medium integrity, medium availability (PBMM) commonly used for cloud services. The Government of Canada's cloud security assessments evaluate providers against these profiles. Provincial governments and many private organizations adopt NIST, ISO 27001 or CIS baselines, often mapped to sector requirements such as OSFI's Guideline B-13 on technology and cyber risk for federally regulated financial institutions.

Scoping and tailoring

Baselines are starting points, not finished designs. Scoping is the process of determining which baseline controls apply to a particular system, by considering its technology, environment and data. A system with no wireless capability does not need wireless controls; a system hosted entirely by a software-as-a-service provider may inherit physical and environmental controls from the provider. Tailoring adjusts the scoped controls to the organization's specific risks and mission: strengthening some with control enhancements, adding supplemental controls, setting parameter values such as password length or log retention, and replacing controls that cannot be applied with compensating controls.

Tailoring decisions must be justified and documented, usually in a system security plan or statement of applicability, and approved by the system and data owners. Removing a control because it is inconvenient is not tailoring; removing it because the risk does not exist, or because a compensating control addresses the same risk, is. Common controls, provided once for many systems, such as a central logging service or an enterprise identity platform, can be inherited, with the inheriting system documenting the dependency.

Selecting standards

The outline also asks you to select standards. Organizations choose which frameworks and standards to follow based on legal and regulatory requirements, contractual obligations, industry expectations, customer demands and their own risk appetite. A Canadian bank will follow OSFI guidelines; a US hospital must meet HIPAA; a retailer accepting cards must meet PCI DSS; a software company selling to enterprises will often pursue ISO 27001 certification or a SOC 2 report because customers ask for them. Many organizations use a unified control framework that maps one set of internal controls to several external standards, so a single control satisfies multiple requirements and evidence is collected once.

Standards selection should be driven by the business, not by fashion. Adopting a framework no customer or regulator requires may still be useful as a structure, but its cost should be justified by the assurance and risk reduction it brings.

Digital rights management

Digital rights management, often called information rights management (IRM) in enterprise settings, applies persistent protection to files so that controls travel with the information wherever it goes. A document protected with rights management is encrypted, and opening it requires authentication against a policy server that checks the user's permissions: view, edit, print, copy, forward, and for how long. Permissions can be revoked later, even after the file has left the organization, and access can be logged. Enterprise sensitivity labels often apply rights management automatically to confidential and restricted documents.

DRM has limitations. It requires compatible software on every device, can frustrate legitimate users and partners, and cannot stop someone photographing a screen or retyping content. It works best for high-value documents shared with a known set of people, such as board papers, merger documents and engineering drawings shared with suppliers. Consumer DRM, used to protect media such as films, music and e-books, follows similar principles and is protected in law against circumvention in both countries, under the Copyright Act in Canada and the Digital Millennium Copyright Act in the United States.

Data loss prevention

Data loss prevention tools discover, monitor and protect sensitive data to stop it leaving the organization inappropriately. Network DLP inspects traffic, such as email and web uploads, at the perimeter or in the cloud. Endpoint DLP runs on devices and controls actions such as copying to USB drives, printing, uploading through browsers and pasting into unapproved applications. Discovery DLP, sometimes called data-at-rest DLP, scans repositories to find sensitive data where it should not be. DLP identifies sensitive content using pattern matching (such as card number formats validated with the Luhn check), keywords, exact data matching against fingerprints of real records, document fingerprinting, machine learning classifiers and, most reliably, the sensitivity labels applied under the classification scheme.

DLP policies can monitor, warn, require justification, encrypt, quarantine or block. A typical rollout starts in monitoring mode to learn normal business flows, then introduces user warnings with justification, and only then blocks clearly prohibited actions. Tuning is critical: too many false positives and users ignore warnings or find workarounds, and analysts drown in alerts; too few rules and real leaks go unnoticed.

Cloud access security brokers

A cloud access security broker (CASB) sits between users and cloud services to give visibility and control over cloud use. CASBs discover which cloud services employees use, including unsanctioned shadow IT, by analysing network logs; rate the risk of each service; enforce policies on sanctioned services through application programming interface connections or inline proxies, such as blocking downloads of confidential files to unmanaged devices; apply DLP to cloud content; detect anomalous behaviour such as mass downloads; and check cloud configurations. CASB capabilities are increasingly delivered as part of security service edge (SSE) or secure access service edge (SASE) platforms, which combine CASB with secure web gateways, zero trust network access and firewall services.

Cloud data security and sovereignty

Data in the cloud needs the same controls as data on premises, applied through the provider's tools and the customer's configuration. Key practices include choosing regions deliberately and covering backups and support access in contracts; encrypting data with customer-managed keys for sensitive data; applying least-privilege identity and access management, which is the most common source of cloud breaches when misconfigured; enabling logging and monitoring; using cloud security posture management to detect misconfigurations such as public storage buckets; and planning exit, including data return and deletion. Data sovereignty concerns, discussed in lesson 6, may lead organizations to use providers or regions under domestic jurisdiction, or to hold their own keys so that the provider cannot be compelled to produce readable data.

Demonstrating compliance

Compliance means showing that controls meet requirements, not just having them. Evidence includes policies and standards, system security plans and statements of applicability, configuration records, access reviews, DLP and CASB reports, sanitization certificates, retention and disposal records, training records, and audit reports. Continuous control monitoring, which checks configurations and collects evidence automatically, reduces the effort and keeps evidence current. Independent assurance, such as ISO 27001 certification, SOC 2 Type II reports, PCI DSS reports on compliance and government assessments, gives customers and regulators confidence. Gaps found by audits feed back into the control set through a plan of action and milestones, tracked to closure by the owners.

Thinking like a manager

Exam questions in this area often ask which technology fits a need, or how to adapt a baseline. Persistent protection for a document after it leaves the organization points to DRM. Detecting or stopping sensitive data leaving points to DLP. Visibility and control over cloud services points to CASB. When a baseline control does not fit, the answer is scoping or tailoring with documented justification and compensating controls, approved by the owner, never silently dropping the control. And when choosing standards, follow legal, regulatory and contractual requirements first.