CIS Controls Data Protection Capability Group

Adversaries modify stored data to affect outcomes or conceal activity. At-rest encryption may hinder offline manipulation where the adversary lacks the decryption key, but it does not prevent modification through an authorized application, database write access, or transparently decrypted storage

Adversaries insert, delete, or manipulate data to influence outcomes or conceal activity. Encrypting sensitive data at rest can prevent an adversary who lacks the decryption capability from understanding the protected content sufficiently to perform targeted or meaningful modifications, reducing the effectiveness of the manipulation.

Encrypting sensitive data at rest prevents dumping credentials from OS caches, memory, or credential structures to obtain hashes or plaintext passwords on domain controller backups.

Private keys are frequently stored on disk. Encrypting storage can reduce exposure from theft of key files, especially during offline access or storage compromise.

Certificates and private keys are commonly stored on disk. Encryption at rest can reduce exposure when attackers attempt to steal certificate material from storage.

Adversaries use automated methods to search for and copy data across systems, cloud APIs, pipelines, or RAT functionality. Encryption at rest can mitigate the automated collection of files/storage objects from being usable when the adversary lacks access to the decryption key.

NTDS dumping targets Active Directory credential material. Encryption and secure storage of DC backups can prevent an adversary who obtains an offline backup from directly accessing NTDS credential material.

Application access tokens are sensitive credential material commonly stored in databases, configuration stores, browser profiles, caches, or application files. Encrypting those tokens at rest can prevent an adversary who obtains raw storage, a database backup, snapshot, or filesystem access from reading and reusing the tokens.

This sub-technique removes scheduled tasks or registry keys after use. Retaining system modification logs according to enterprise timelines ensures the lifecycle of the persistence mechanism remains fully reviewable.

This sub-technique permanently purges emails to hide phishing or exfiltration. CIS 3.4 requires a minimum retention window for email archives, blocking adversaries from destroying corporate messaging records.

This sub-technique wipes local network state data and active connection logs. Enforcing retention timelines on network telemetry ensures lateral movement records survive local configuration resets.

This sub-technique purges terminal histories like .bash_history or PowerShell logs. Data retention policies mandate logging shell commands directly to a central repository, preserving the operational history despite local terminal purges.

This technique targets local Windows security and system event logs. Enforcing a minimum retention timeline ensures Windows event data is moved off-host and preserved, defeating local log-clearing attempts.

This technique deletes critical Unix artifacts like /var/log system logs. Documented retention processes guarantee that Unix system trails are streamed to a repository where minimum storage timelines are strictly enforced.

This overarching technique covers deleting artifacts across an environment. CIS 3.4 protects the evidence chain by establishing mandatory retention periods that an attacker cannot alter or shorten.

Retention is protective because it limits the time window in which valuable data remains available for destruction, tampering, or cleanup by an attacker. Data retention policies protect against adversaries deleting logs by mandating strict storage lifecycles, off-site replication, and immutability.

Credentials and authentication material are often stored within files, databases, configuration repositories, and application data stores. Encrypting sensitive data at rest reduces the usefulness of credential artifacts obtained from protected storage locations by preventing direct access to plaintext credential material.

Secure disposal reduces sensitive data retained in cloud object storage, lowering the value of compromised storage access

This applies when secure disposal explicitly removes old credential files, keys, exports, secrets, or configuration files that could expose credentials.

Secure disposal reduces stale sensitive records in repositories such as document stores, collaboration platforms, or knowledge bases.

Secure disposal reduces obsolete or unnecessary sensitive data left on shared drives, limiting what an adversary can collect from network shares.

Secure disposal reduces residual sensitive files on endpoints and servers that an adversary could later collect from local storage.

Segregated cloud environments reduce exposure of sensitive cloud storage resources.

Segmentation directly limits attacker movement between remote-accessible systems and sensitive environments.

Data Retention restricts, hardens against, or increases visibility into the adversary behavior.

Retention is protective because it limits the time window in which valuable data remains available for destruction, tampering, or cleanup by an attacker.

DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. DLP solutions commonly inspect and restrict uploads to external cloud services.

DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. DLP inspection capabilities may identify sensitive-data transfer across non-standard protocols.

DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. Web upload monitoring and restriction are core DLP use cases.

DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. Device-control and removable-media DLP policies directly target USB-based exfiltration.

DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. DLP solutions explicitly monitor and restrict unauthorized outbound transfer of sensitive data.

Encryption protects sensitive shared-drive data against unauthorized disclosure

Cloud storage encryption directly protects sensitive stored cloud data.

Repository encryption protects stored sensitive data even after unauthorized access.

Encryption at rest directly reduces usability of stolen or accessed local data.

Transport encryption directly constrains interception and manipulation of communications.

Encryption in transit directly mitigates readable interception of network traffic.

Encrypting removable media directly reduces the usefulness of data exfiltrated via USB storage devices.

The safeguard explicitly protects removable-media-stored data from unauthorized access.

Encryption protects copied endpoint data stored on removable media from unauthorized disclosure.

Encryption on endpoints reduces the value of locally collected data and raises the bar for simple exfiltration after collection.

The safeguard specifically concerns secure deletion and sanitization of residual data artifacts.

This control protects against attacker behaviors that destroy or overwrite data and storage media.

Secure disposal directly addresses preventing unauthorized recovery or persistence of sensitive data remnants.

ACLs constrain which accounts can reach data and therefore directly reduce abuse of valid accounts and local data access for collection.

The control either restricts, detects, hardens against, or increases visibility into the adversary behavior associated with this technique. The control reduces unauthorized access opportunities and raises the difficulty of account misuse.