CIS Control 3: Data Protection Encryption and Classification

What Is CIS Control 3: Data Protection?

CIS Control 3 covers the processes and technical controls required to protect data throughout its lifecycle—creation, storage, transmission, processing, and destruction. The control is organized into four safeguard categories within CIS Controls v8:

• 3.1 – Data Classification and Handling: Establish and maintain a data classification scheme based on sensitivity and criticality. Enforce handling procedures for each classification level.
• 3.2 – Encryption of Data at Rest: Deploy encryption mechanisms on all endpoints, servers, cloud storage volumes, and database systems where sensitive data resides.
• 3.3 – Encryption of Data in Transit: Enforce TLS, SSH, or equivalent protocols for all data traversing internal and external networks. Block legacy, unencrypted protocols.
• 3.4 – Cryptographic Key and Certificate Management: Maintain a centralized inventory of keys and certificates, enforce rotation schedules, and revoke compromised credentials immediately.
• 3.5 – Removable Media and Portable Device Encryption: Apply encryption to all portable storage devices and enforce policy through endpoint controls.
• 3.6 – Data Disposal and Retention: Securely delete data that is no longer needed according to retention schedules, using cryptographic erasure or degaussing.
• 3.7 – Data Leakage Prevention (DLP): Monitor and block unauthorized data exfiltration across email, web, cloud storage, and removable media.
• 3.8 – Data Recovery and Backup Encryption: Ensure backup data is encrypted at rest and in transit, with tested recovery procedures.
• 3.9 – Automated Monitoring of Data Protection Controls: Continuously assess the configuration state of data protection mechanisms against the CIS Benchmark baseline.

Each safeguard maps to specific CIS Benchmarks for operating systems, applications, cloud platforms, and network devices. The goal is not a static policy document but a continuously validated set of configuration baselines that prevent data exposure.

Why CIS Control 3 Matters for Enterprise Compliance

Data protection controls are a shared requirement across nearly every regulatory framework. The overlap between CIS Controls v8 and major compliance regimes is significant:

Auditors increasingly expect evidence of continuous configuration validation, not point-in-time screenshots. This is where automated tools like CyberSilo's top 10 CIS benchmarking tools ranking come into play—they provide the audit trail and scoring that demonstrates control effectiveness across the enterprise.

Data Classification: The Foundation for Encryption

You cannot encrypt what you have not classified. CIS Control 3.1 requires a classification scheme that defines at minimum three tiers: public, internal, and restricted/confidential. Each classification level must have explicit handling and encryption requirements.

Classification Scheme Requirements

An effective data classification program under CIS Control 3 includes:

• Data inventory: Automated discovery of structured and unstructured data across on-premises file shares, cloud storage buckets, databases, and endpoints.
• Classification labels: Metadata tags applied at the file system, database column, or cloud object level.
• Policy integration: Classification tags are consumed by encryption policies, DLP rules, and access control systems.
• User training: Data owners and custodians understand their classification responsibilities.
• Automated reclassification: Rules that detect unlabeled data and either auto-classify or flag for manual review.

Without a functioning classification scheme, encryption becomes a guessing game—you either over-encrypt everything (causing performance and operational friction) or under-encrypt critical assets. CIS Benchmark guidance recommends starting with a limited set of classification rules and expanding as the data inventory matures.

Handling Procedures by Classification

Encryption at Rest: CIS Benchmark Configuration

CIS Control 3.2 requires encryption for all data at rest where the classification level demands it. The implementation varies by platform, but the CIS Benchmarks provide specific configuration guidance for each operating system, cloud provider, and database system.

Server Encryption Baselines

For Linux servers, the CIS Benchmark for Red Hat Enterprise Linux 9 requires full-disk encryption using LUKS2 with AES-256-XTS, a separate /boot partition, and secure key storage. For Windows Server 2022, the benchmark mandates BitLocker enabled on all fixed drives, TPM 2.0 attestation, and recovery key escrow to Active Directory.

Cloud workloads require a different approach. The CIS Benchmarks for AWS, Azure, and GCP specify that EBS volumes, managed disks, and persistent disks should use customer-managed encryption keys (CMEK) or key management service (KMS) keys with automatic rotation. The benchmark also checks that default encryption is enabled at the account level to prevent unencrypted volume creation.

Database encryption is another critical layer. The CIS Benchmark for Microsoft SQL Server requires Transparent Data Encryption (TDE) for all user databases, with the database encryption key protected by a certificate backed up to a secure location. For PostgreSQL, the benchmark demands pgcrypto extension for column-level encryption of sensitive fields and encryption of WAL logs for replication streams.

Endpoint Encryption Requirements

Endpoints represent the largest attack surface for unencrypted data. The CIS Benchmark for macOS 14 Sonoma requires FileVault 2 with full-disk encryption, secure token delegation, and institutional recovery key escrow. For Windows 11, the benchmark mandates BitLocker with 256-bit XTS-AES, TPM + PIN protector, and recovery password backup to Entra ID.

The critical configuration check here is encryption key protection. Many organizations implement disk encryption but store the recovery key in a location accessible to the user, effectively defeating the control. CIS Benchmark configuration validation specifically checks that recovery keys are escrowed to enterprise management tools and are not accessible by standard users.

Encryption in Transit: Enforcing Protocols and Cipher Suites

CIS Control 3.3 addresses network-level encryption. The control does not simply say "use encryption"—it requires specific protocol versions, cipher suite restrictions, and deprecation of legacy protocols.

TLS Configuration Benchmarks

The CIS Benchmark for web servers, load balancers, and API gateways uniformly requires TLS 1.2 minimum, with TLS 1.3 strongly recommended. The cipher suite order must prioritize forward secrecy: TLS_AES_256_GCM_SHA384 should be the preferred suite for TLS 1.3, and TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 for TLS 1.2.

Key configuration checks across CIS Benchmarks include:

• Server-side enforcement: The server must reject TLS 1.0 and 1.1 connections entirely, not simply deprioritize them.
• Cipher suite blacklist : Disable all CBC-mode ciphers, RC4, 3DES, and export-grade suites.
• Certificate validation: Certificates must be signed by a trusted CA; self-signed certs require explicit policy exception and validation.
• HSTS enforcement: HTTP Strict-Transport-Security header must be configured with a max-age of at least 31536000 seconds.
• Mutual TLS: For internal service-to-service communication, mutual TLS with certificate-based client authentication is the benchmark requirement.

SSH and Remote Access

For remote administration, the CIS Benchmark for OpenSSH on Linux requires: protocol 2 only, key-based authentication with ed25519 or RSA 4096+ keys, disabled root login, and strict host key checking. For Windows, the benchmark requires WinRM over HTTPS with certificate-based authentication and disabled Basic Authentication.

Cryptographic Key and Certificate Management

CIS Control 3.4 is frequently the most neglected safeguard because it requires operational maturity beyond initial setup. The benchmark requirements here go beyond "use encryption" to how you manage the keys that enable it.

Key Management System Requirements

The CIS Benchmarks across platforms require:

• Hardware security module (HSM) or certified cloud KMS for all key generation and storage of master keys.
• Key rotation: Customer-managed encryption keys must be rotated automatically every 365 days or less.
• Key inventory: Automated discovery and tracking of all keys, certificates, and secrets across the environment.
• Key escrow: All encryption keys must have a secure backup that is accessible only under break-glass procedures.
• Certificate lifecycle management: Automated discovery, renewal, and revocation of TLS certificates. Certificate transparency monitoring is recommended.
• Revocation workflows: Immediate revocation of keys and certificates when a compromise is suspected or an employee with key access departs.

Common Benchmark Failures in Key Management

When scanning against the CIS Benchmark for key management, the most frequent findings include:

• Default keys (AWS managed keys, Azure platform-managed keys) used for sensitive data without migration to customer-managed keys.
• No automated certificate expiration monitoring, leading to application outages or unencrypted fallback connections.
• Key rotation disabled on KMS keys due to operational convenience.
• Local admin accounts on servers with access to the machine's BitLocker or LUKS recovery keys.
• No separation of duties between key administrators and system administrators.

These findings are configuration drift failures that top 10 compliance automation tools can detect continuously, reducing the window between misconfiguration and detection.

Removable Media and Portable Device Encryption

CIS Control 3.5 addresses a persistent vulnerability: data exfiltration through portable storage. The benchmark requirements include:

• Mandatory encryption: All removable media (USB drives, external SSDs, SD cards) must use hardware or software encryption. Unencrypted removable media must be blocked at the OS level.
• Endpoint enforcement: Group Policy or MDM profiles must disable AutoRun, limit write access to authorized devices only, and enforce BitLocker To Go or equivalent.
• Portable device encryption: Laptops, tablets, and mobile devices must use full-disk encryption with enterprise key escrow.
• Data transfer logging: All file transfers to removable media must be logged and monitored for volume anomalies.

The CIS Benchmark for Windows 11 explicitly checks that "Deny write access to removable storage not protected by BitLocker" policy is enabled. For macOS, the benchmark verifies that FileVault is active on all portable devices and that mobile device management profiles enforce the same for corporate-owned iOS devices.

Data Disposal and Retention: Secure Lifecycle Termination

CIS Control 3.6 requires organizations to securely dispose of data when it is no longer needed, according to legal and regulatory retention schedules.

Secure Deletion Methods

The benchmark does not accept simple file deletion or "empty recycle bin." Secure deletion must use methods appropriate to the storage medium:

• SSDs and NVMe drives: Cryptographic erasure via ATA Secure Erase or NVMe Format NVM command.
• HDDs: Overwriting with verified patterns (DoD 5220.22-M standard or NIST SP 800-88 Clear/Purge).
• Cloud storage: Deletion of encryption keys to make data cryptographically inaccessible, combined with object deletion.
• Physical media: Degaussing or physical destruction (shredding, pulverizing) for media that reaches end of life.
• Virtual machines and snapshots: Detach and delete encrypted volumes; do not leave orphaned EBS or managed disk snapshots containing sensitive data.

Configuration validation against the CIS Benchmark for cloud providers checks that backup retention policies do not retain sensitive data beyond the organization's retention schedule, and that deletion of backup snapshots includes the underlying encrypted blocks.

Data Leakage Prevention (DLP) Controls

CIS Control 3.7 extends data protection to active monitoring and blocking of unauthorized data movement. While DLP is traditionally a separate product category, the CIS Control framework integrates it as a data protection requirement.

Benchmark DLP Configuration

The CIS Benchmarks for endpoints and cloud platforms include DLP-relevant configuration checks:

• Clipboard monitoring: Prevent paste of sensitive data from managed to unmanaged applications.
• Printer controls: Restrict printing of classified documents to authorized printers with audit logging.
• Email controls: Block outbound email containing credit card numbers, SSNs, or other PII patterns.
• Cloud sync blocking: Prevent data exfiltration through personal cloud storage accounts.
• USB and peripheral control: Block unauthorized mass storage devices and Bluetooth file transfers.

The benchmark checks validate that these controls are enabled, not just licensed. A common failure is installing a DLP agent but leaving it in "monitor only" mode, which satisfies no audit requirement.

Data Recovery and Backup Encryption

CIS Control 3.8 ensures that the last line of defense—backups—are equally protected. The benchmark requirements include:

• Backup encryption at rest: All backup storage targets (tape, disk, cloud) must use AES-256 encryption.
• Backup encryption in transit: Backup data streams over the network must use TLS 1.2+ or IPsec.
• Encryption key separation: Backup encryption keys must be stored separately from the backup data and the primary encryption keys.
• Tested recovery: Quarterly recovery tests from encrypted backups, with documented verification that encryption does not impede restoration.
• Immutable backup copies: Air-gapped or immutable copies of critical data to prevent ransomware encryption of the backup itself.

The CIS Benchmark for backup applications validates that backup jobs are configured with encryption enabled, that encryption keys are rotated, and that recovery tests include validation of decryption capability.

Automated Monitoring of Data Protection Controls

CIS Control 3.9 is the meta-control: it requires automated, continuous validation that all other data protection safeguards remain in effect. This is where traditional compliance programs fail—they assess quarterly or annually, leaving months of exposure when a configuration drifts.

Continuous Compliance Validation

Organizations implementing CIS Control 3.9 typically deploy an automated benchmarking tool that performs the following functions:

• Baseline definition: Map CIS Benchmark findings for encryption, key management, classification, and DLP to a scoring model.
• Periodic scanning: Run configuration assessments across all target systems at least weekly, or trigger scans on configuration change events.
• Drift detection: Compare current configuration state against the last known compliant baseline and alert on deviations.
• Remediation workflow: Assign findings to system owners with severity-based SLAs and track closure.
• Audit evidence generation: Produce timestamped, immutable reports of configuration status over time for auditor review.

This is the specific capability that CyberSilo's CIS Benchmarking Tool provides—continuous validation across all of CIS Control 3, integrated into existing SIEM and ticketing workflows. Without this monitoring layer, organizations cannot demonstrate operational compliance between audit periods.

Implementing CIS Control 3: A Phased Workflow

Implementing data protection controls across a large enterprise requires a phased approach. The following workflow aligns with CIS Implementation Groups, starting with Essential (IG1), advancing to Foundational (IG2), and reaching Organizational (IG3) maturity.

Measuring Success: CIS Control 3 Scorecard

A mature data protection program can be measured against a hardening score that CIS Implementation Groups define. Organizations should aim for the following maturity indicators within 12 months: