Data-centric security means protecting the information itself, wherever it travels, instead of relying mainly on the network or device that holds it. In practice that is four things: know what data you have, classify it, attach controls such as encryption and access rules to it, and log how it is used.
Why shift focus from the perimeter to the data?
NIST SP 800-207 on zero trust describes protection centered on resources such as assets, services and workflows, not on network segments, because network location is no longer the main factor in a resource's security posture. Data is the most basic resource. If a copy of a customer file leaves through a personal cloud folder or a contractor's laptop, no network control around your data center will follow it.
The problem is simple: data moves faster and farther than the boundaries drawn around it.
What are the building blocks?
Classification. NIST FIPS 199 provides a standard for categorizing information and systems by the level of concern for confidentiality, integrity and availability, and the potential impact if each is lost. NIST SP 800-60 maps types of information to those categories. You do not need federal categories. You need a short scheme your staff can apply, such as public, internal, confidential and restricted.
Encryption. NIST SP 800-111 explains storage encryption, the use of encryption and authentication to restrict access to stored information, and describes full disk, volume or virtual disk, and file or folder encryption. Which fits depends on the type of storage, the amount of data, where it lives and the threats you want to counter. Encryption at the file or field level travels with the data, which is the data-centric choice, though it costs more in key management.
Access tied to the data. Rules based on who the person is, what the data's class is, and the context of the request, rather than only which network the person is on.
Visibility. Logs that show who read, copied, shared or deleted a restricted item.
A constructed example
A 200-person consulting firm keeps client reports in a shared drive. Everyone in the firm can open every folder, and the network is protected by a VPN. The firm classifies reports as restricted if they contain client financial data. For that class it turns on encryption with keys managed by the firm, limits access to the engagement team, blocks sharing links to outside addresses, and logs every download. When a consultant leaves, access to restricted folders ends the same day, with no need to hunt for copies in other places, because the files stayed in managed storage.
What goes wrong?
- Classification that nobody keeps up. If labels depend on manual tagging, they drift.
- Encryption with keys stored beside the data, which protects little.
- Policies written for the data's home, then ignored when data is exported into spreadsheets and email.
- Over-collection. Data that is never collected cannot leak. Deleting what you no longer need is a control.
How to check or apply this
- Pick the one kind of data that would hurt most if it leaked, such as customer financials, health records or source code.
- Find every place it lives: databases, drives, email, laptops, backups, SaaS tools and AI tools.
- Write a four-level classification scheme on one page and label that one data type.
- For the top level, require encryption at rest and in transit, with keys held separately, and restrict access to named groups.
- Turn on access logging for that data, and review alerts for bulk downloads and external shares.
- Set a retention period and delete what has passed it.
- After 90 days, test it: ask someone to find and share a restricted file outside policy, and see what stops them.
Quick check
Does data-centric security replace network security?
No. It adds a layer that stays with the data when network controls do not apply. Both are needed, and NIST describes the shift as emphasizing resources, not as dropping network controls.
Is encryption enough?
Not alone. Encrypted data is still readable by anyone who holds the key or an authorized session, so access rules, key management and logging matter as much.
Sources
- NIST SP 800-207, Zero Trust Architecture
- NIST FIPS 199, Standards for Security Categorization
- NIST SP 800-60 Vol. 1 Rev. 1, Mapping Types of Information to Security Categories
- NIST SP 800-111, Guide to Storage Encryption Technologies for End User Devices
Last reviewed: 18 October 2026.
