# SP-013 Data Security Pattern

Status: published. Release 26.02. Modified 2026-02-06. Licence: CC BY-SA 4.0.

Scope: Security architecture for classifying, protecting, and controlling data throughout its lifecycle. Covers data classification schemes, encryption at rest and in transit, media handling, access enforcement, information flow controls, and data retention and disposal obligations.
Use when: Organisations that process Personally Identifiable Information (PII), operate in regulated sectors (financial services, healthcare, government, defence), process commercially sensitive information, handle payment card data subject to PCI DSS, or manage intellectual property that represents competitive advantage. Any organisation subject to data protection regulations including GDPR, CCPA, HIPAA, or sector-specific...
Not when: Publicly available information that is freely available from multiple sources and carries no confidentiality, integrity, or regulatory obligation.

## Controls (33, NIST SP 800-53 ids)
- Critical (5): AC-03, AC-04, AC-06, RA-02, SC-09
- Important (14): AC-02, AC-05, AC-15, AC-16, CA-07, IA-02, MP-02, MP-06, PL-05, RA-03, SC-07, SC-08, SC-13, SI-12
- Standard (14): AC-20, AT-02, AT-03, CP-09, MP-03, MP-04, MP-05, PE-03, PE-19, RA-01, RA-04, SC-04, SI-09, SI-10
- Withdrawn from SP 800-53 by NIST: AC-15 (now in MP-03); PL-05 (now in RA-08); RA-04 (now in RA-03); SC-09 (now in SC-08); SI-09 (now in AC-02, AC-03, AC-05, AC-06)

## What each critical control mitigates (5)
- AC-03 Access Enforcement: T-DS-001, T-DS-008
- AC-04 Information Flow Enforcement: T-DS-001, T-DS-002, T-DS-007
- AC-06 Least Privilege: T-DS-002, T-DS-006
- RA-02 Security Categorization: T-DS-005
- SC-09 Transmission Confidentiality: T-DS-003

## Threats and the controls that mitigate them (10)
- T-DS-001 Data Exfiltration by External Attacker: AC-03, AC-04, SC-07, SC-13
- T-DS-002 Insider Data Theft or Negligent Exposure: AC-05, AC-06, AC-04, AT-02
- T-DS-003 Data Interception in Transit: SC-08, SC-09, SC-13
- T-DS-004 Improper Media Disposal Leading to Data Leakage: MP-06, MP-04, SC-04
- T-DS-005 Misclassification Leading to Inadequate Protection: RA-02, AC-15, AC-16, AT-02
- T-DS-006 Unauthorised Data Access via Stolen Credentials: IA-02, AC-02, AC-06, CA-07
- T-DS-007 Data Loss from Uncontrolled External Systems: AC-20, SC-07, AC-04
- T-DS-008 Data Integrity Compromise via Input Manipulation: SI-09, SI-10, AC-03
- T-DS-009 Regulatory Non-Compliance from Inadequate Data Handling: PL-05, RA-01, SI-12, MP-03
- T-DS-010 Removable Media Theft or Loss: MP-02, MP-05, SC-13, PE-03

## More
- The critical controls and what each mitigates, as JSON (a few KB): /api/v1/patterns/SP-013/crosswalk?emphasis=critical
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-013/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 25 KB: /api/v1/patterns/SP-013
- Page for people: /patterns/sp-013/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-010 Identity Management Pattern; SP-014 Awareness and Training Pattern; SP-019 Secure Ad-Hoc File Exchange Pattern; SP-018 Information Security Management System; SP-025 Advanced Monitoring and Detection

This card, the API and the page are generated from one file. Checking one against another adds no evidence.