IAC-48: Software Defined Storage (SDS) Data Access Control
Automated mechanisms exist to utilize Software Defined Storage (SDS), or equivalent technologies, to enforce data access controls that: (1) Prevent access by unauthorized entities and by entities operating from unauthorized devices; and (2) Segregate access between communities of interest for data residing within the same classification level.
Renumbered: Formerly CLD-15 in SCF 2025.4.
Control Question: Does the organization use automated mechanisms to utilize Software Defined Storage (SDS), or equivalent technologies, to enforce data access controls that: (1) Prevent access by unauthorized entities and by entities operating from unauthorized devices; and (2) Segregate access between communities of interest for data residing within the same classification level?
US (1)
| Framework | Mapping Values |
|---|---|
| USA Federal DoD Zero Trust Execution Roadmap v1.1 | 4.2.3 4.7 4.7.1 4.7.2 4.7.3 4.7.4 4.7.5 4.7.6 4.7.7 |
Capability Maturity Model
Level 0 — Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 — Performed Informally
Cloud Security (CLD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with CLD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Cloud management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
Level 2 — Planned & Tracked
SCR-CMM Level 2 criteria definitions are not available for this control: ▪ A reasonable person would conclude a well-defined and standardized process is required. ▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization. ▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 — Well Defined
Identification & Authentication (IAC) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are well-documented and kept current by process owners. ▪ An Identity & Access Management (IAM) team, or similar function, is appropriately staffed and supported to implement and maintain IAC domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of IAM operations (e.g., directory services, Authenticate, Authorize and Audit (AAA) solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to automatically utilize Software Defined Storage (SDS) to scale access management permissions to TAASD.
Level 4 — Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 — Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Assessment Objectives
- IAC-48_A01 Software Defined Storage (SDS), or equivalent technologies, are used to automatically enforce data access controls.
- IAC-48_A02 the enforced data access controls prevent access to data by unauthorized entities.
- IAC-48_A03 the enforced data access controls prevent access to data by entities operating from unauthorized devices.
- IAC-48_A04 the communities of interest between which data access is segregated within the same classification level are defined.
- IAC-48_A05 the enforced data access controls segregate access between the defined communities of interest for data residing within the same classification level.
Technology Recommendations
Micro/Small
- Note: Typically not required at this size
Small
- Note: Typically not required at this size
Medium
- Storage access controls preventing unauthorized volume access (e.g., cloud storage IAM, SAN zoning)
Large
- Software Defined Storage with policy-based access controls (e.g., VMware vSAN, Ceph, NetApp ONTAP)
- Immutable/WORM storage for critical data
Enterprise
- Enterprise SDS platform with policy-driven data access enforcement, encryption and immutability (e.g., Dell PowerScale, NetApp, Pure Storage SafeMode)
- Storage security monitoring