Cloud Data Security Principles

This section covers the data layer of a cloud estate — what protects the data itself, rather than the code that handles it. It is organised around three questions: what has to be true of data while it moves and while it sits still, what vocabulary to use when deciding which controls to apply, and what to do when sensitive values have to flow through systems that should never hold them.

Application-level controls — output encoding, deserialization, credential handling — are covered under Security.

• Data in transit and at rest — the concrete controls: protocol versions, key management, access control, monitoring and the standards to align against.
• Security controls and data protection framework — the vocabulary: preventive and directive controls, data minimisation, separation of duties, blast radius and single points of failure.
• Vaultless tokenization — substituting sensitive values algorithmically instead of storing a token-to-value map.

Where an external framework is needed as the reference point, use the NIST Cybersecurity Framework for the control structure and the Cloud Security Alliance guidance for cloud-specific detail; ISO/IEC 27001 with 27017 and 27018 covers the certification route.