NIST CSF PR.DS-01 - Protection of data at rest (legacy record alias)
Assess the selected CSF 2.0 data-at-rest protection outcome for the documented project and data scope
Where this comes from
Provision: PR.DS-01 - Protection of data at rest (legacy record alias)
Instrument: NIST Cybersecurity Framework 2.0 (February 2024)
Citation: NIST CSWP 29, NIST Cybersecurity Framework 2.0, 26 February 2024, Appendix A, PR.DS-01; section 3 Organizational Profiles. The stable database ID is a legacy alias and does not change the official identifier.
Text version: CSF 2.0
Checked against the source: 6 September 2026
Who it applies to
It applies when all of these are true:
- NIST CSF 2.0 Target Profile adopted: YES
- PR.DS: Which outcomes are selected in this project's Target Profile? is PR.DS-01
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Confirm selected PR.DS-01 in the documented CSF 2.0 Target Profile, including stored-data boundaries, organizational roles, profile owner/version and tailoring; PR.DS-02 is the distinct data-in-transit outcome.
- Identify the assessed stored-data confidentiality, integrity and availability risks and choose proportionate safeguards, with measurable acceptance criteria and accountable owners.
- Verify confidentiality against unauthorized access, integrity against unauthorized change and availability under the assessed failure scenarios; record remaining gaps with scoped evidence.
- Where encryption is chosen, test the assessed key access, protection, lifecycle and recovery controls using synthetic keys and data. PR.DS-01 does not itself prescribe an algorithm, product, encryption layer or rotation period.
- Keep data-in-transit, data-in-use and backup outcomes separate unless explicitly selected and assessed; do not treat a storage-decision document or a checked task as proof of all security outcomes.
Evidence an auditor expects
- Assessment documentDocument review
Selected PR.DS-01 stored-data protection assessment
Confirm selected PR.DS-01 in the documented CSF 2.0 Target Profile, including stored-data boundaries, organizational roles, profile owner/version and tailoring; PR.DS-02 is the distinct data-in-transit outcome. Identify the assessed stored-data confidentiality, integrity and availability risks and choose proportionate safeguards, with measurable acceptance criteria and accountable owners. Verify confidentiality against unauthorized access, integrity against unauthorized change and availability under the assessed failure scenarios; record remaining gaps with scoped evidence. Where encryption is chosen, test the assessed key access, protection, lifecycle and recovery controls using synthetic keys and data. PR.DS-01 does not itself prescribe an algorithm, product, encryption layer or rotation period. Keep data-in-transit, data-in-use and backup outcomes separate unless explicitly selected and assessed; do not treat a storage-decision document or a checked task as proof of all security outcomes.
Questions people ask
- Does NIST CSF PR.DS-01 - Protection of data at rest (legacy record alias) apply to my service?
- It applies when NIST CSF 2.0 Target Profile adopted: YES; PR.DS: Which outcomes are selected in this project's Target Profile? is PR.DS-01.
- From when does this apply?
- NIST CSF PR.DS-01 - Protection of data at rest (legacy record alias) applies from 26 February 2024. Its current status is: in force.
- What evidence does an auditor expect?
- Selected PR.DS-01 stored-data protection assessment.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.