Pillar 4: Data
Data is the asset Zero Trust ultimately protects. This pillar focuses on transparency and visibility enabled by enterprise infrastructure, applications, standards, robust end-to-end encryption, and data tagging/classification.
Key principles
- Data is classified and labeled before access policy can be applied to it.
- Encryption is applied by default, not as an exception.
- Access to data is governed by policy tied to sensitivity, not just to the system that stores it.
Maturity snapshot
| Stage | Characteristics |
|---|---|
| Traditional | Manual, inconsistent classification; encryption applied ad hoc |
| Advanced | Automated DLP/CASB-driven classification; policy-enforced encryption across most stores |
| Optimal | Continuous ML-assisted classification driving real-time access policy; end-to-end encryption with centralized key management |
Related capabilities
See Data Classification & Labeling and Encryption at Rest & In Transit in the capability matrix.
Framework tie-ins
NIST 800-53 (RA, SC families), GLBA Safeguards Rule (16 CFR 314.4(c)), PCI-DSS v4.0 (Req. 3, 4), NYDFS 500 (500.03, 500.15).
Capabilities in this pillar
Data Classification & Labeling
Manual, inconsistent classification
Automated classification via DLP/CASB tooling
Continuous, ML-assisted classification enforcing access policy in real time
Encryption at Rest & In Transit
Encryption applied inconsistently, mostly in transit only
Encryption enforced by policy across most data stores and channels
End-to-end encryption with centralized key management and rotation
Key Management / HSM
Software-based key storage; manual rotation
Centralized KMS/HSM with policy-based rotation
Hardware-backed, automated key lifecycle management with real-time revocation
Data Residency & Sovereignty Controls
No enforcement of data location
Policy-based data residency enforcement for regulated data
Automated, continuously verified data residency compliance across all storage and processing locations