PR.DS-10 is about data while a program is working on it, in memory and in processors, as opposed to data stored on disk or moving over a network. The outcome is that its confidentiality, integrity and availability are protected there too.
CSF is voluntary guidance. There is no CSF certification, and this outcome is the one most teams have thought about least.
What good looks like
Sensitive data does not linger in memory, logs or temporary files longer than it is needed. One user or process cannot read another's working data on the same platform. Shared hosts, containers and multi tenant services are set up so tenants are isolated.
How to implement it
- Find where sensitive data is processed: services handling secrets, personal data or payment data.
- Clear it when done. Avoid long lived caches, core dumps and verbose logs that capture it.
- Isolate workloads. Use separate accounts, containers or namespaces for different trust levels, and limit who can attach a debugger or open a shell on production.
- Where a provider offers confidential computing options and your risk calls for it, evaluate them. Many small teams will not need this.
- Review the settings annually and after major architecture changes.
Evidence to collect
- A note on where sensitive data is processed and the isolation in place
- Configuration showing debug and shell access limits on production
- Log settings showing sensitive fields are not captured
- Decision record if you evaluated and declined confidential computing
Common gaps
- Secrets and personal data appear in application logs
- Production shell access is open to the whole engineering team
- Memory dumps are stored without protection
Quick check
Do we need special hardware to meet PR.DS-10?
No. NIST's examples focus on removing confidential data once it is no longer needed and protecting it from other users and processes on the same platform. Both are achievable with ordinary configuration.
Sources
- NIST Cybersecurity Framework 2.0 (CSWP 29): https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 Reference Tool, implementation examples for PR.DS-10: https://csrc.nist.gov/projects/cybersecurity-framework/filters
