NIST SP 800-53 Rev 5
SC - System and Communications Protection

NIST SP 800-53 Rev 5 NIST800-SC-28: SC-28 Protection of Information at Rest

Protect the [Selection (one or more): confidentiality; integrity] of the following information at rest: [Assignment: organization-defined information at rest].

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 90 controls across 34 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 13 controls

  • 10.1.1 10.1.1 Requirement 10 policies and procedures maintained and in use
  • 3.3.2 3.3.2 Pre-authorization SAD stored electronically is strongly encrypted
  • 3.3.3 3.3.3 Issuer SAD storage limited, justified and encrypted
  • 3.5.1 3.5.1 Stored PAN rendered unreadable
  • 3.5.1.2 3.5.1.2 Disk or partition encryption only on removable media
  • 3.5.1.3 3.5.1.3 Disk encryption access independent of OS authentication
  • 3.7.3 3.7.3 Secure storage of cryptographic keys
  • 6.5.5 6.5.5 No live PANs in pre-production
  • 8.3.2 8.3.2 Authentication factors unreadable with strong cryptography
  • 9.2.4 9.2.4 Locking of consoles in sensitive areas
  • 3.4.1 3.4.1 PAN masked on display except for authorized roles
  • 3.6.1 3.6.1 Procedures protect keys against disclosure and misuse
  • 3.7.1 3.7.1 Generation of strong cryptographic keys

ISO 27001:2022 · 6 controls

  • 6.7 Remote working
  • 8.1 User end point devices
  • 8.11 Data masking
  • 8.12 Data leakage prevention
  • 8.3 Information access restriction
  • 8.33 Test information

AWS Well-Architected Security Pillar · 5 controls

CMMC 2.0 · 5 controls

SOC 2 · 5 controls

  • SOC2-C1.1 C1.1 Identifying and maintaining confidential information
  • SOC2-C1.2 C1.2 Disposing of confidential information
  • SOC2-CC6.5 CC6.5 Protecting data on assets until disposal
  • SOC2-P4.3 P4.3 Securely disposing of personal information
  • SOC2-PI1.5 PI1.5 Controls over stored inputs, work in process and outputs

CIS Controls v8 · 4 controls

  • CIS-11.3 Protect Recovery Data
  • CIS-3.11 Encrypt Sensitive Data at Rest
  • CIS-3.6 Encrypt Data on End-User Devices
  • CIS-3.9 Encrypt Data on Removable Media

FedRAMP High · 4 controls

  • AC-19(5) Full Device or Container-Based Encryption
  • CP-9(8) System Backup | Cryptographic Protection (CP-9(8))
  • SC-28 Protection of Information at Rest
  • SC-28(1) Cryptographic Protection

FedRAMP Moderate · 4 controls

  • AC-19(5) Full Device or Container-Based Encryption
  • CP-9(8) System Backup | Cryptographic Protection (CP-9(8))
  • SC-28 Protection of Information at Rest
  • SC-28(1) Cryptographic Protection

ISO 27002:2022 · 4 controls

  • 7.7 Clear desk and clear screen
  • 7.9 Security of assets off-premises
  • 8.11 Data masking
  • 8.24 Use of cryptography

ISO 27701:2019 · 4 controls

Azure Security Benchmark · 3 controls

  • ASBv3-DP-5 Use customer-managed key option in data at rest encryption when required
  • BR-2 Protect backup and recovery data
  • DP-4 Enable data at rest encryption by default

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

  • ANSSI-HYG-11 Protect Passwords Stored on Systems
  • ANSSI-HYG-31 Encrypt Sensitive Data, in Particular on Equipment That May Be Lost

APPI · 2 controls

  • APPI-A23 Security Control Measures
  • APPI-A46 Security and Proper Handling of Anonymized Personal Information

ASEAN Data Management Framework · 2 controls

  • ADMF-5.2 Apply technical, procedural and physical safeguards
  • ADMF-5.3 Protect data across the data lifecycle

African Union Malabo Convention · 2 controls

NIST SP 800-171 · 2 controls

NIST SP 800-171 Rev 3 · 2 controls

  • 03.08.09 System Backup - Cryptographic Protection
  • 03.13.11 Cryptographic Protection

3GPP 5G Security Architecture (TS 33.501) · 1 control

ASIC Cyber Resilience Good Practices · 1 control

Albania Law No. 124/2024 on Personal Data Protection · 1 control

  • AL-DPA-10 Security of Processing

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-2 Secure the network and systems within the data environment

C5 (Germany) · 1 control

  • C5-CRY-03 Encryption of sensitive data for storage

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-37 Protection of Swap Data Repository Data

CNCF Security Technical Advisory Group (TAG) · 1 control

GDPR · 1 control

HIPAA Security Rule · 1 control

NIS2 Directive · 1 control

  • Art.21.2.h Policies and procedures on the use of cryptography and, where appropriate, encryption

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-207 · 1 control

NIST SP 800-53 Rev 5 HIGH · 1 control

  • SC-28 SC-28 Protection of Information at Rest

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • SC-28 SC-28 Protection of Information at Rest

NIST SP 800-66 Rev 2 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in SC - System and Communications Protection

You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done?

NIST SP 800-53 Rev 5 NIST800-SC-28 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.

If you hold ISO 27001:202216.1% covered · 851 gapsIf you hold ISO 27002:202210.8% covered · 904 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.110.2% covered · 911 gapsIf you hold CIS Controls v810.1% covered · 912 gapsIf you hold NIST SP 800-171 Rev 310.1% covered · 912 gapsIf you hold C5 (Germany)9.6% covered · 917 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 90 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-53 Rev 5 controls