NIST SP 800-209r1 (Security Guidelines for Storage Infrastructure, Initial Public Draft)

Track; not yet

Why

The draft is credible and squarely relevant to our storage security posture, but it is self-described as provisional — committing remediation effort against control names/acronyms that NIST itself flags as open to revision during the comment period risks rework; better to wait for the finalized text before treating it as a compliance target.

Next

Re-review after the September 8, 2026 comment period closes and NIST finalizes SP 800-209r1; then diff the seven finalized control families — Data Storage Governance (DSGV), Physical Controls for Data Storage (PSDS), Storage Systems Security (DSSS), Data Protection and Recovery (DPRC), Storage Networking and Technologies (SNTC), Encryption and Key Management (ENKM), and Storage Disposal and Reuse (SDRU) — against current backup, encryption, and isolation posture (Rule #7 RLS, Rule #31 canary migrations, Rule #40 robust structures) to identify concrete gaps.