Updated 1 Nov 2026 · 6 min read
On this page
After reading this you will be able to name the three data states and the controls NIST associates with each, list the three United States classification levels and what separates them, recognise the data classification labels in the Security+ SY0-701 objectives, and tell the data owner, controller, processor, custodian and steward roles apart. Each definition below comes from a primary source.
The three data states
NIST Cybersecurity Framework (CSF) 2.0, published on 26 February 2024, has a separate outcome for each state: PR.DS-01 protects the confidentiality, integrity and availability of data at rest, PR.DS-02 does the same for data in transit, and PR.DS-10 for data in use.
- Data at rest: NIST SP 800-53 Rev. 5 (control SC-28) describes information at rest as information that is not in process or in transit and is located on system components, such as hard disk drives, storage area network devices or databases.
- Data in transit: SP 800-53 control SC-8 covers transmitted information, on internal and external networks and on any component that can transmit it, from servers and notebook computers to printers and radios. It warns that unprotected communication paths are exposed to interception and modification.
- Data in use: data being processed, the state SC-28 contrasts with data at rest. NIST IR 8320 discusses it in terms of applications running in memory, and points out that most encryption solutions protect data at rest and do not cover the fact that the data is decrypted and vulnerable while in use.
Controls for each state
| State | Controls named in the NIST source |
|---|---|
| At rest (SP 800-53 SC-28) | Cryptographic mechanisms and file share scanning for confidentiality and integrity. Write-once-read-many (WORM) technology for integrity. Moving information to secure offline storage. Protected storage for cryptographic keys, with a Trusted Platform Module (TPM) given as an example. |
| In transit (SP 800-53 SC-8) | Encryption, with TLS and IPsec as the named cryptographic mechanisms. Cryptographic hash functions, as used in digital signatures, checksums and message authentication codes, for integrity. Protected distribution systems as a physical option. |
| In use (NIST IR 8320) | Confidential computing, which uses hardware-enabled features to isolate and process encrypted data in memory, including trusted execution environments (TEEs). |
The SY0-701 objectives list the methods to secure data as geographic restrictions, encryption, hashing, masking, tokenization, obfuscation, segmentation and permission restrictions. The CISSP outline gives digital rights management (DRM), data loss prevention (DLP) and cloud access security brokers (CASB) as examples of data protection methods.
Government classification levels
In the United States, Executive Order 13526, Classified National Security Information (29 December 2009), sets the levels. Information may be classified at one of three levels, each defined by the damage its unauthorised disclosure could reasonably be expected to cause to national security:
| Level | Expected damage from unauthorised disclosure |
|---|---|
| Top Secret | Exceptionally grave damage to the national security |
| Secret | Serious damage to the national security |
| Confidential | Damage to the national security |
Three rules in the order are worth knowing. Except as provided by statute, no other terms may be used to identify United States classified information. If there is significant doubt about the appropriate level, the information is classified at the lower level. If there is significant doubt about the need to classify at all, it is not classified.
Unclassified is therefore not a fourth level in the order. Unclassified information that still needs safeguarding or dissemination controls is handled by a separate programme, Controlled Unclassified Information (CUI), established by Executive Order 13556. The CNSSI 4009-2022 definition in the NIST glossary is narrower still: unclassified information is information that needs neither CUI safeguarding under Executive Order 13556 nor protection under Executive Order 13526 or the Atomic Energy Act of 1954.
The SY0-701 classification labels
The SY0-701 objectives list a different set of data classifications: sensitive, confidential, public, restricted, private and critical. The objectives list these labels without defining or ranking them, so do not assume a fixed order between, for example, restricted and confidential.
People often mix up the two schemes because the word Confidential appears in both. In Executive Order 13526 it is a national security level with a legal definition. In the SY0-701 list it is one of six data classification labels, which the objectives do not define.
Some NIST definitions tie classification to the owner. NIST SP 800-30 Rev. 1 and SP 800-39 define the information owner as the official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, classification, collection, processing, dissemination and disposal. The later definition used in SP 800-37 Rev. 2 and SP 800-53 Rev. 5 is the same except that it leaves out classification.
Data roles
| Role | Definition and source |
|---|---|
| Owner | Has authority for the information and responsibility for establishing its controls, including classification in the NIST SP 800-30 Rev. 1 wording. |
| Controller | Alone or jointly with other controllers, decides the purpose and means of data processing operations (European Data Protection Board, GDPR). |
| Processor | Processes personal data on behalf of the controller (European Data Protection Board, GDPR). |
| Steward | Enforces policies and regularly assesses classification criteria and tests compliance (one of the CNSSI 4009-2022 definitions in the NIST glossary). |
| Custodian | Listed by both SY0-701 and the CISSP outline. Neither document defines the role, so use the definition in your course material. |
The EDPB describes controllers and processors as the actors responsible for compliance with the different rules in the GDPR. In the EDPB's wording, the controller decides the purpose and means of processing, and the processor processes personal data on the controller's behalf. Note that SY0-701 lists custodians and stewards as a single entry, "Custodians/stewards", while the CISSP outline lists owners, controllers, custodians, processors and users/subjects.
How this fits your exam
CompTIA Security+ SY0-701: objective 3.3, "Compare and contrast concepts and strategies to protect data", lists the data classifications (sensitive, confidential, public, restricted, private, critical), the data states (data at rest, data in transit, data in use) and the methods to secure data. Objective 5.1 lists the roles and responsibilities for systems and data as owners, controllers, processors and custodians/stewards. CompTIA lists the SY0-701 English retirement date as 11 June 2027 and expects Security+ V8 to launch on or around 17 November 2026. See the Security+ SY0-701 study guide.
ISC2 CISSP: the exam outline effective 15 April 2024 places this material in Domain 2, Asset Security, which has an average weight of 10%. Objective 2.1 covers data classification, 2.4 lists data roles (owners, controllers, custodians, processors, users/subjects), and 2.6 lists data states (in use, in transit, at rest) and data protection methods. The CISSP study guide covers the other domains.
Frequently asked questions
Which data state does TLS protect?
Data in transit. NIST SP 800-53 control enhancement SC-8(1) names TLS and IPsec as cryptographic mechanisms that protect the confidentiality and integrity of information during transmission. Once the data arrives and is written to disk, it is data at rest and needs its own protection under SC-28.
Is Unclassified a US government classification level?
No. Executive Order 13526 defines exactly three levels: Top Secret, Secret and Confidential, and says that, except as provided by statute, no other terms may be used to identify classified information. Controlled Unclassified Information has its own programme under Executive Order 13556.
Is encryption enough to protect data in use?
Not on its own. NIST IR 8320 notes that most encryption solutions protect data at rest and do not cover the fact that data is decrypted and vulnerable while in use. It describes protecting cloud data while in use, also called confidential computing, as using hardware-enabled features to isolate and process encrypted data in memory.
Sources
- CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0
- CISSP Certification Exam Outline
- Executive Order 13526, Classified National Security Information
- NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
- NIST IR 8320, Hardware-Enabled Security
- Controller/processor, European Data Protection Board
Practise classification and data role questions with the Security+ SY0-701 practice questions, or read the CISSP exam guide.