Data Security Architecture and Controls
What this domain tests
This domain tests control selection and justification. You will be asked which technical and organisational measures meet Art 32 in a given risk context, and how those measures map onto recognised frameworks such as ISO/IEC 27001, NIST CSF and CIS Controls.
Core rules
- Art 32 factors. State of the art, implementation cost, nature/scope/context/purposes of processing, and risk severity. Measures named: encryption, ongoing confidentiality/integrity/availability/resilience, restore capability, and regular testing.
- Defence in depth. Layered controls across identity, endpoint, network, application, data and monitoring, so no single failure is fatal. Segmentation and microsegmentation limit blast radius.
- Zero trust. Verify explicitly, grant least privilege, assume breach. It replaces implicit network trust; it does not abolish authentication.
- Control families. PAM and least privilege; encryption, tokenisation and masking; WAF, firewalls, egress filtering; endpoint detection; SIEM and UEBA with retained logs; immutable backups with tested RTO/RPO; vulnerability management and patching; secure SDLC, threat modelling (STRIDE) and penetration testing.
- Frameworks. NIST CSF 2.0 functions are Govern, Identify, Protect, Detect, Respond, Recover. ISO/IEC 27001 Annex A gives a control catalogue and certification route. SOC 2 reports against trust services criteria.
Worked example
A SaaS provider stores customer PII in a multi-tenant database. Controls chosen: envelope encryption with keys in a managed KMS, tokenisation of payment fields so the database never holds card numbers, dynamic masking in non-production environments, RBAC with quarterly access recertification, immutable audit logs for privileged access, and encrypted backups with quarterly restore tests. Justification ties each control to an Art 32 factor and to a NIST CSF function: Protect for encryption and RBAC, Detect for logging, Recover for backups. Reasoning: state the risk, name the control, then show the framework mapping.
Traps that cost marks
Listing controls without linking each to a risk; confusing pseudonymisation with encryption; treating backups as an archive or a retention tool; reading zero trust as no perimeter controls at all; forgetting to log and retain privileged access events; assuming a framework certificate proves the controls operate.