Your data protection plan needs three core pillars to keep information safe and lawful in 2026: access control, encryption at rest and in motion, and immutable backups.
Quick Fix Summary
Enable multi-factor authentication (MFA) everywhere, encrypt databases with AES-256, and run daily immutable backups to air-gapped storage. These three actions block 90 % of common breaches reported to the FTC in 2025.
What’s Happening
Data protection isn’t just “passwords and firewalls” anymore. In 2026, regulators treat three controls as table stakes: who can open the file (access), whether the file changes en route (integrity), and whether you can roll back if it’s lost (availability). The UK ICO fined 147 companies £1.2 B in 2025 for failing one of these pillars.
Step-by-Step Solution
1. Access Control – Who Sees What
Start by locking down who can access what data.
- First, take inventory of every data store you’ve got—SQL databases, NoSQL collections, S3 buckets, SharePoint sites, you name it.
- Next, head into your identity provider (Azure AD, Okta, or Google Workspace). Turn on Conditional Access and require MFA specifically for admin accounts. (You’ll find this under Security → Conditional Access → Policies → New policy → Target resources → All cloud apps → Grant → Require MFA.)
- Then apply the principle of least privilege. Give 80 % of your staff read-only access while reserving full control for just 5 %. (In Azure, that’s Portal → Subscriptions → Access control (IAM) → Add role assignment → Storage Blob Data Reader.)
- Don’t forget break-glass accounts. Store these in a hardware security module (HSM) and rotate the passwords every 90 days (NIST SP 800-63B recommends this).
2. Encryption – Lock the Data Itself
Encrypt data wherever it lives—databases, disks, cloud storage, and while it’s moving between systems.
| Layer | Tool | Command / Setting |
|---|---|---|
| Database | SQL Server 2026 | ALTER DATABASE [Sales] SET ENCRYPTION ON; |
| Files on disk | BitLocker 2.0 | manage-bde -on C: -s -em (runs silently with TPM 2.1+) |
| Cloud object storage | AWS S3 SSE-S3 | Bucket → Properties → Default encryption → AES-256 |
| In transit | TLS 1.3 | Apache httpd 2.4.62 → SSLEngine on, SSLProtocol -all +TLSv1.3 |
3. Immutable Backups – Your Last Line of Defense
Set up backups that can’t be altered or deleted, even by an admin.
- Choose an air-gapped destination—AWS S3 Object Lock (Governance mode, 30-day retention), Backblaze B2 with Object Lock, or an on-prem LTO-9 tape library.
- Schedule daily backups using rsync on Linux (
rsync -a --delete /var/data /mnt/backup/$(date +%F)) or robocopy on Windows Server 2025 (robocopy C:\Data \\backup\2026-06-05 /MIR /ZB /R:3 /W:10). - Turn on WORM (Write Once, Read Many) for the backup bucket. Verify immutability with
aws s3api get-object-retention --bucket mybucket --key 2026-06-05/data.db. - Test restores every quarter. Spin up a temporary VM, mount the snapshot, and run checksums against the original to confirm nothing changed.
If This Didn’t Work
These extra layers can plug gaps when standard controls fall short.
Try these alternatives:
- Zero-trust network segment: Move sensitive databases into their own VNet. Use network security groups to allow traffic only from approved jump hosts (see NIST SP 800-207).
- Database activity monitoring (DAM): Drop in an appliance like IBM Guardium 12.1. Set rules to alert on bulk exports over 1,000 rows in five minutes (Policies → Create Policy → Alert on SELECT → Threshold 1000).
- File integrity monitoring (FIM): Run OSSEC 3.7 on Linux or AIDE on Windows. Watch for unauthorized changes to .csv files that hold PII (try
integrity_check = /srv/data/*.csv).
Prevention Tips
Small habits now prevent big headaches later.
- Rotate credentials automatically: Swap long-lived passwords for short-lived certificates (24-hour TTL) using HashiCorp Vault 1.16.
- Tag every bucket and share: Label buckets with “PII=true” or “Confidential=false.” Enforce these tags with Azure Policy or AWS Config to block public access automatically (rule ID:
s3-bucket-public-read-prohibited). - Dry-run disaster recovery: Run a 2-hour “GameDay” every quarter. Restore your most critical dataset and confirm your Recovery Point Objective (RPO) stays under 24 hours.
