Data Storage and Processing Controls
Data Storage and Processing Controls tests whether you can protect data where it rests and while it is being processed, and whether you can reduce scope rather than merely add controls. Questions often ask which technique removes data from a regulated scope versus which one only obscures it.
Protecting data at rest and in transit
Encryption at rest with AES-256 and in transit with TLS 1.2 or higher is baseline. The hard part is key management: generation in a hardware security module or managed key service, rotation, separation of duties between key administrators and data administrators, and documented recovery so that losing a key does not mean losing the business. Envelope encryption wraps a data key with a key-encryption key, so rotating the master key does not require re-encrypting the corpus.
Distinguish three techniques that are often conflated. Encryption is reversible with the key and satisfies most regulatory protection duties. Tokenization replaces a value with a surrogate held in a vault; because the original never lives in the protected store, it is the strongest scope-reduction tool - PCI DSS explicitly allows tokenized card data to fall outside the cardholder data environment. Masking obscures values for a viewer, statically in a copy or dynamically at query time; it does not change the classification of the underlying store.
Processing controls
Processing integrity controls: input validation and edit checks, batch totals and reconciliation, checksums and hashes, idempotent processing, four-eyes approval for high-impact jobs, and immutable logs of who ran what. Segmentation, database activity monitoring and cloud data security posture tools detect drift. Under the shared responsibility model the provider secures the infrastructure, but you remain accountable for configuration, identities and data.
Worked example
A call centre records calls, and agents read out card numbers, putting the telephony platform inside the cardholder data environment. Reasoning: the recording store holds cardholder data in cleartext, so scope follows the data. The fix is pause-and-resume recording or DTMF masking, so digits are never written to storage; if a number must persist, tokenize it. Result: the telephony platform leaves scope, which shrinks audit effort and risk far more than encrypting the recordings would. Evidence it with an updated data-flow diagram.
Traps that cost marks
Masking in the user interface while exports and warehouse copies stay cleartext. Assuming a cloud provider encrypts every service by default. Letting the provider hold the only key, which means the provider can read the data. Confusing tokenization with hashing, which is one-way.