Protect 2.3.3 Data security Ensure that information, data and data carriers are managed in a way which protects the confidentiality, integrity and availability of the data in accordance with the organisation’s risk strategy. Description Task PR.DS-1 Ensure that stored data is protected (against violations of confidentiality, integrity and availability). PR.DS-2 Ensure that data is protected while in transit (against violations of confidentiality, integrity and availability). PR.DS-3 Ensure that you have a formal procedure in place for your ICT assets which protects data upon removal, transfer or the replacement of those assets. PR.DS-4 Ensure that your ICT assets have sufficient capacity to ensure data availability is maintained. PR.DS-5 Ensure that appropriate action has been taken to prevent data leaks. PR.DS-6 Establish a procedure to check the integrity of firmware, operating systems, application software and data. PR.DS-7 Provide a development and testing IT environment which is completely separate from productive systems. PR.DS-8 Establish a procedure to check the integrity of the hardware you use. Table 19: PR.DS tasks Standard Reference COBIT 5 APO01.06, BAI02.01, BAI06.01, DSS06.06, BAI09.03, APO13.01, BAI07.04, BAI03.05.4 ISA 62443-3:2013 SR 3.4, SR 4.1, SR 3.1, SR 3.8, SR 4.1, SR 4.2, SR 7.1, SR 7.2, SR 5.2 ISO 27001:2013 A.8.2.3, A.13.1.1, A.13.2.1, A.13.2.3, A.14.1.2, A.14.1.3, A.8.3.1, A.8.3.2, A.8.3.3, A.11.2.7, A.12.3.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, A.13.1.3, A.13.2.1, A.12.2.1, A.12.5.1, A.14.1.2, A.14.1.3 NIST-SP-800-53 Rev. 4 SC-28, SC-8, CM-8, MP-6, PE-16, AU-4, CP-2, SC-5, AC-4, AC-5, AC-6, PE-19, PS-3, PS-6, SC-7, SC-8, SC-13, SC-31, SI-4, SI-7, CM-2, SA-10 BSI M 2.217, B 4.1, M 2.393, B 5.3, B 5.4, B 5.21, B 5.24, B 1.7, M 2.3, B 1.15, M 5.23, M 3.33, M 2.226, M 3.2, M 3.6, B 1.18, M 2.220, M 2.8, M 4.135, M 4.494, M 5.77, M 2.393, B 5.3, M 3.55, B 5.4, B 5.21, B 5.24, B 1.7, B 1.6, B 1.9, B 5.4, B 5.21, B 5.24, M 2.62, M 2.4 Table 20: PR.DS references Minimum ICT standard 2018 23