PR.DS-02 asks that the confidentiality, integrity and availability of data in transit are protected. In practice that means encrypted connections everywhere data moves, controls on what leaves by email or file sharing, and a rule that production data does not flow into test systems.
CSF is voluntary guidance. There is no CSF certification, so the goal is to be able to explain and show your controls.
What good looks like
All external traffic uses TLS, and internal service to service traffic is encrypted too. Outbound email and file transfers that contain sensitive data are automatically encrypted or blocked according to the data classification. Personal email, personal file sharing and personal storage are blocked from company systems. Developers cannot copy customer records into development or test environments.
How to implement it
- Map the flows. List where sensitive data travels: customer web traffic, APIs, service calls, email, file transfers, vendor integrations.
- Enforce TLS on every public endpoint, redirect plain HTTP, and retire old protocol versions.
- Encrypt internal links between services, databases and message queues, using mutual TLS where practical.
- Set up data loss rules in your email and file sharing platform so sensitive content is encrypted or blocked.
- Block personal webmail and consumer file sharing on managed devices and networks, and give people a sanctioned alternative.
- Prohibit production data in non production environments. Use synthetic or masked data, and add a check in your pipeline that flags real records.
Evidence to collect
- A data flow diagram or list with the protection used on each flow
- TLS configuration scan results for your public endpoints
- Email and file sharing policy settings showing encryption or blocking rules
- Web filter or device policy blocking personal services
- A written rule on test data, with a sample of masked data in use
Common gaps
- Internal traffic is plain text because "it is inside the network"
- Vendors receive data by unencrypted file transfer
- Test databases are restored from production backups
- Email rules exist but only cover a few keywords
Quick check
Is TLS on the website enough for this outcome?
No. It covers one flow. The outcome also covers internal traffic, email, file transfers and the handling of production data in other environments.
Sources
- NIST Cybersecurity Framework 2.0 (CSWP 29): https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 Reference Tool, implementation examples for PR.DS-02: https://csrc.nist.gov/projects/cybersecurity-framework/filters
