Which risk management strategy will ensure the secure storage of data on a new document management system?

The most effective risk management strategy to ensure the secure storage of data is the implementation of encryption for data at rest. Encryption transforms data into an unreadable format, ensuring its confidentiality even if an unauthorized party gains access to the physical storage media or the system's files. This control directly addresses the risk of data exposure from a compromised storage system, which is the core requirement of "secure storage." While other measures are important, they protect access points and transit, not the stored data itself.

A. This is an access control policy. While important for authentication, it does not protect the underlying data if the storage is breached through other means.

B. A firewall is a network security control that protects the system's perimeter from unauthorized network traffic. It does not secure the data stored on the server's disks.

D. A VPN secures data in transit for remote users. It provides no protection for the data once it is stored (at rest) on the document management system's server.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53, Revision 5).

Reference: Control SC-28 PROTECTION OF INFORMATION AT REST, Section 2, Page 259. This control explicitly states, "Protect the confidentiality and integrity of [Assignment: organization-defined information at rest] using [Assignment: organization-defined mechanisms]." The discussion section highlights encryption as a primary mechanism.

2. National Institute of Standards and Technology (NIST). (2020). Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (NIST Special Publication 800-171, Revision 2).

Reference: Requirement 3.13.16, Page 23. This requirement mandates to "Protect the confidentiality of CUI at rest." The discussion clarifies that this is to prevent unauthorized disclosure if the storage media is lost, stolen, or accessed improperly, with encryption being a key solution.

3. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9), 1278–1308.

Reference: Section A, "Design Principles," Principle 4, "Complete mediation," and Principle 8, "Least privilege." While a foundational paper, it establishes the principle that protection mechanisms must be applied directly to the object being secured (the data), which encryption does, rather than relying solely on perimeter or access controls. (DOI: https://doi.org/10.1109/PROC.1975.9939)

4. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014.

Reference: Lecture 15 Notes: Storage Security. The lecture notes detail various methods for securing stored data, with a primary focus on Full-Disk Encryption (FDE) and file-based encryption as fundamental strategies to ensure the confidentiality of data at rest.