Skip to content

Data in Use

What is Data in Use?

Data that is actively being processed, read, or modified in memory by a CPU or application. Protecting data in use is more challenging than data at rest or in transit and may involve techniques such as confidential computing.

Information Security

Frameworks that govern data in use

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on data in use

Requirements naming data in use across 5 standards, quoted from the control text.

NIST Cybersecurity Framework 2.01 control

The confidentiality, integrity, and availability of data-in-use are protected. Control from NIST Cybersecurity Framework 2.0 framework, domain: PR - Protect.

NIST-CSF-PR.DS-10 · The confidentiality, integrity, and availability of data-in-use are protected →
DORA RTS on ICT Risk Management Framework (Commission Delegated Regulation (EU) 2024/1774)2 controls

Entities under Article 16(1) must, using the Article 30 classification, protect networks against intrusion and misuse and preserve data availability, authenticity, integrity and confidentiality by: protecting data in use, in transit and at rest;

dora-rts-on-ict-risk-management-framework-commission-delegated-regulation-eu-2024-1774::35 · Article 35: Data, system and network security (simplified framework) →
EDM Council CDMC - Cloud Data Management Capability Framework2 controls

Sovereignty and cross-border movement requirements and rules are documented; a comprehensive set of controls is defined and approved;

edm-council-cdmc-cloud-data-management-capability-framework::1.4.2 · 1.4.2 Data sovereignty and cross-border data movement risks are managed →
NIST SP 800-1441 control

Apply Section 7 encryption and key management in cloud including: data at rest (provider-managed encryption + customer-managed encryption keys CMEK + Bring Your Own Key BYOK + Hold Your Own Key HYOK) + data in transit (TLS 1.3 + IPsec + mTLS) + data in use (co...

NISTSP144-4 · Encryption, Key Management, and BYOK →
NIST SP 800-53 Rev 51 control

(a) Approve, document, and control the use of live data in preproduction environments for the system, system component, or system service;

NIST800-SA-3(2) · SA-3(2) System Development Life Cycle | Use of Live or Operational Data →

Questions people ask about data in use

What is Data in Use?
Data that is actively being processed, read, or modified in memory by a CPU or application. Protecting data in use is more challenging than data at rest or in transit and may involve techniques such as confidential computing.
Why is Data in Use important for compliance?
Data in Use is a key concept in Information Security. Understanding data in use helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Data in Use?
Data in Use appears in the requirement text of NIST Cybersecurity Framework 2.0, DORA RTS on ICT Risk Management Framework (Commission Delegated Regulation (EU) 2024/1774), EDM Council CDMC - Cloud Data Management Capability Framework, NIST SP 800-144, NIST SP 800-53 Rev 5. Across these standards we have identified 7 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Data in Use?
Explore our compliance framework pages to see how data in use applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Data in Use applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.