FR 4 — Data Confidentiality (DC)

Protect sensitive information at rest and in transit, including credentials, configuration, logs, and operational data.

• Encrypted channels for control plane operations and remote access
• Protection of identity and policy artifacts with strong crypto and access controls
• Immutable evidence that preserves confidentiality while enabling audit
• Key hygiene and integration with enterprise key management where required

• Scope by zone: identify where this FR is most critical (e.g., safety zone, engineering access, remote vendor conduit).
• Start in observe mode: baseline behavior and identify necessary exceptions.
• Enforce gradually: enable controls in phases aligned to maintenance windows; document exceptions.
• Continuously verify: monitor drift and anomalies; automate response where safe.

• Encryption configuration evidence
• Access logs for sensitive artifacts
• Key rotation and policy change records