Cloud data protection controls serve three goals that NIST defines as confidentiality, integrity and availability. Encryption at rest and in transit protects stored and moving data. Least privilege access and multifactor authentication limit who reaches the data. Encryption alone is not enough so add backups, monitoring and written policies.
Your business stores client files in the cloud and someone asks which controls protect them. Clear lists answer that question and show gaps.
This guide groups data protection controls by the goal they serve and cites official sources for every group.
What are the Goals of Data Protection Controls?
| Goal | NIST Definition |
|---|---|
| Confidentiality | The property that sensitive information is not disclosed to unauthorized entities |
| Integrity | Guarding against improper information modification or destruction |
| Availability | Ensuring timely and reliable access to and use of information |
See the NIST glossary entries for confidentiality, integrity and availability.
How does Encryption Protect Cloud Data?
Microsoft states that data at rest is information in persistent storage on physical media and that Azure applies AES 256 encryption to data at rest across SaaS, PaaS and IaaS. For data in transit it lists TLS, HTTPS, SMB encryption and VPN tunnels. See Azure encryption overview.
- Service managed keys. Provide a combination of control and convenience with low overhead.
- Customer managed keys. Give you control over the keys including bring your own key support.
- Client side encryption. You maintain full control of the keys and the provider cannot decrypt the data.
How do You Control Who Reaches the Data?
Microsoft recommends that you grant administrators exactly the permission they need for a specific scope and period. It also recommends multifactor authentication for all administrator accounts. See Microsoft Entra role best practices.
- Give every person a separate account.
- Assign roles with the least privilege that works.
- Enable multifactor authentication on administrator accounts.
- Review role assignments on a schedule.
Is Encryption Alone Enough?
No. HHS makes this point in its HIPAA cloud guidance. It states that encryption does not address integrity, availability or administrative and physical safeguards. See HHS guidance on HIPAA and cloud computing.
This logic applies outside healthcare too. Pair encryption with backups for availability and with written policies for administration.
What Administrative Controls do You Need?
- Written policies. Define who can store which data in which service.
- Training. Teach staff to recognize phishing and report incidents.
- Backups. Store a tested copy outside the cloud account.
- Provider review. Confirm in writing which security duties the provider performs.
For threats these controls address see the top security issues in cloud computing. For basic account steps see online security measures for your business.
Frequently Asked Questions
What are Data Protection Controls?
They are technical and administrative measures that protect data. NIST frames three goals for protecting data.
Should I Encrypt Data in the Cloud?
Yes. Microsoft describes encryption at rest and in transit and lists several key management choices.
Who Manages Encryption Keys?
That depends on the option. Service managed keys sit with the provider while client side encryption leaves full control with you.
Is Encryption Enough to Protect Cloud Data?
No. HHS states that encryption does not address integrity, availability or administrative and physical safeguards.
What is Least Privilege?
Microsoft describes it as granting administrators exactly the permission they need to do their job.
Key Takeaways
- NIST names three goals for data protection.
- Encryption protects data at rest and in transit.
- Least privilege and multifactor authentication limit access.
- Encryption alone does not protect integrity or availability.
- Backups, policies and training round out the control set.
Sources and References
This guide follows NIST, Microsoft and HHS documentation.
- Confidentiality (NIST Glossary) csrc.nist.gov
- Integrity (NIST Glossary) csrc.nist.gov
- Availability (NIST Glossary) csrc.nist.gov
- Azure Encryption Overview (Microsoft Learn) learn.microsoft.com
- Best Practices for Microsoft Entra Roles (Microsoft Learn) learn.microsoft.com
- HIPAA and Cloud Computing (HHS) www.hhs.gov