Date Published: July 22, 2026
Comments Due:
Email Comments to:
Author(s)
Ramaswamy Chandramouli (NIST), Eric Hibbard (Samsung Semiconductor)
Announcement
Storage technology has evolved in two primary directions: (1) increased media storage capacity and (2) architectural changes that provide a software-based abstraction over all forms of background storage technologies. However, the latter evolution has increased management complexity and the probability of configuration errors and associated security threats. This document traces the evolution of the storage technology landscape and analyzes current security threats and resultant risks to provide a comprehensive set of security recommendations in the form of storage security controls.
Important updates in this revision of SP 800-209 include:
- Section 2 — Removal of content associated with obsolete and/or proprietary technologies.
- Section 3 — Completely revised to primarily focus on threats and risks that are specific to storage systems and ecosystems. References to other NIST publications are provided for generic ICT threats and risks. Two notable focus areas were also added:
- “Platform Security Compromises” — Focuses on threats associated with the underlying/supporting infrastructure for data storage
- “Compromised Data Resilience/Protection” — Focuses on threats to secondary data assets and the secondary data asset generation process (i.e., backups)
- Section 4 — Retitled as “Storage Security Controls.” The security recommendations have been reorganized from nine categories into seven formalized control families with standardized control acronyms.
- Several new control families have been added, and some existing controls have been consolidated under new control families to provide coverage for all threats and risks covered in previous sections.
- Appendix C — Added to provide a complete list of the storage security controls described in Sec. 4 as well as a mapping of mitigating controls for the storage-oriented threats identified in Sec. 3.
NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
Storage technology has evolved in two primary directions: increased media storage capacity and architectural changes that provide a software-based abstraction over all forms of background storage technologies. However, this architectural shift has increased management complexity and the probability of configuration errors and associated security threats. This document provides an overview of the evolution of the storage technology landscape, current security threats, and the resultant risks to provide a comprehensive set of security recommendations in the form of storage security controls. These recommendations span security management areas that are common to an information technology (IT) infrastructure as well as those specific to storage infrastructure.
Storage technology has evolved in two primary directions: increased media storage capacity and architectural changes that provide a software-based abstraction over all forms of background storage technologies. However, this architectural shift has increased management complexity and the probability...
See full abstract
Storage technology has evolved in two primary directions: increased media storage capacity and architectural changes that provide a software-based abstraction over all forms of background storage technologies. However, this architectural shift has increased management complexity and the probability of configuration errors and associated security threats. This document provides an overview of the evolution of the storage technology landscape, current security threats, and the resultant risks to provide a comprehensive set of security recommendations in the form of storage security controls. These recommendations span security management areas that are common to an information technology (IT) infrastructure as well as those specific to storage infrastructure.
Hide full abstract
Keywords
backup; block storage service; cloud storage; data protection; file storage service; hyper-converged storage; network-attached storage; object storage service; replication; software-defined storage; storage area network; storage array; storage virtualization
Control Families
None selected
