Stored Data and Key Boundary

Leave a decision open when its value is unknown. Suggested values become confirmed only through an explicit user decision.

• Which stores and copies hold this data, including backups, snapshots, exports, replicas and caches?The primary database is usually the one that gets protected. The copies made by backup jobs, analytics exports and log pipelines are where this tends to go wrong, and the service cannot infer that list from the feature description.DAT-007-Q1 · scope
• Who holds the key that opens this data, and what else does that key open?A key held by the same platform that holds the data, and one held separately, protect against different things. Neither is wrong, but the difference has to be a decision, and the scope of a key is what determines how much one compromise reaches.DAT-007-Q2 · choice
• What happens when a key has to be replaced?Replacement is the part that is usually discovered during an incident. Data already written under the old key still has to be readable, or the replacement destroys it.DAT-007-Q3 · choice

• DAT-007-R1Record every store and copy that holds the data, including backups, snapshots, exports, replicas, caches and log destinations, and state what protects each one at rest.
• DAT-007-R2State who holds the key for each protected store and what else that key opens, so the reach of a single compromised key is a recorded decision rather than an assumption.
• DAT-007-R3Provide a key replacement path that keeps data written under a previous key readable, and record each replacement without recording the key.

• STORED_COPY_COVERAGE_TESTEnumerate the stores and copies the system actually writes to and verify each one appears in the recorded list with a stated protection.
• KEY_SCOPE_TESTVerify that a key scoped to one store cannot open another store the record says it does not cover.
• KEY_REPLACEMENT_TESTReplace a key and verify that data written under the previous key is still readable and that the replacement is recorded.

• configuration_or_policy
• implementation_location
• test_result
• operational_procedure

Passing a published example shows that example's behavior. A coding agent's implementation report remains a claim until its evidence is independently checked.

• SC-28 · Protection of Information at RestNIST_SP_800_53_5_2_0 · partially addressesNaming stores and copies, stating key ownership and scope, and requiring a replacement path address the design decisions behind protection at rest. They do not cover cryptographic implementation, media sanitization, or deployed storage configuration.
• SC-12 · Cryptographic Key Establishment and ManagementNIST_SP_800_53_5_2_0 · partially addressesConfirming who holds a key, what it opens, and how it is replaced addresses part of key management as a design decision; it does not cover key generation, distribution, escrow, or algorithm selection.
• CP-9 · System BackupNIST_SP_800_53_5_2_0 · partially addressesRequiring backups and snapshots to appear in the protected-store list addresses their confidentiality only. Backup scheduling, coverage and restore testing are addressed separately by REL-004.

Mappings indicate contextual relevance or partial support. They do not establish equivalence, certification, government endorsement, or complete framework implementation.

• National Institute of Standards and Technology — Security and Privacy Controls for Information Systems and OrganizationsGUIDANCE_NIST_SP_800_53_5_2_0
• National Institute of Standards and Technology — Privacy FrameworkGUIDANCE_DATA_MINIMIZATION