4.1. Data Security Concepts

💡 First Principle: Data security is about protecting data throughout its entire lifecycle—while it's stored, while it's moving, and when it's no longer needed. A gap in any of these phases creates exploitable exposure. The principles of what to protect, how long to keep it, and where to store it are the foundation of any data security program.

Encryption is the technical mechanism; retention policies and storage decisions are the governance mechanisms. Both are required—encryption without retention policies leaves data exposed indefinitely; retention without encryption exposes it in transit or at rest.