Data in Transit Security Controls

Data in transit security controls govern the protection of information as it moves between systems, networks, devices, or geographic locations. This reference covers the technical mechanisms, regulatory requirements, classification boundaries, and decision logic that define how the service sector approaches transmission security. The scope spans network-layer encryption, protocol standards, and compliance obligations across healthcare, financial services, and federal information systems.

Definition and scope

Data in transit — also called data in motion — refers to information actively moving across a network, including internal local area networks, wide area networks, the public internet, and point-to-point connections between endpoints. The exposure window is the interval during which data leaves one system boundary and arrives at another, a period during which unprotected packets are susceptible to interception, alteration, or replay attacks.

NIST SP 800-53, Rev. 5 addresses transmission confidentiality and integrity under control families SC-8 (Transmission Confidentiality and Integrity) and SC-28 (Protection of Information at Rest), with SC-8 specifically requiring cryptographic protections for data moving across external networks. The HIPAA Security Rule at 45 CFR § 164.312(e)(1) establishes a standard for transmission security applicable to electronic protected health information, requiring covered entities to guard against unauthorized access during electronic transmission.

The PCI DSS standard, published by the PCI Security Standards Council, requires under Requirement 4 that cardholder data be encrypted during transmission over open, public networks — a requirement that encompasses all internet-facing payment flows. Federal civilian agencies operating under FISMA must implement transmission controls consistent with FIPS 140-2 or FIPS 140-3, the cryptographic module validation standards issued by NIST's Cryptographic Module Validation Program.

Three primary asset categories fall under this control domain:

1. Personally identifiable information (PII) — names, Social Security numbers, financial account data
2. Protected health information (PHI) — clinical records, prescription data, insurance identifiers governed by HIPAA
3. Controlled unclassified information (CUI) — federal data categories requiring handling under NIST SP 800-171

The Data Security Providers on this reference network organize technical and compliance service providers by these asset categories.

How it works

Transmission security operates through a stack of controls applied at different layers of the OSI model. The most widely deployed mechanism is Transport Layer Security (TLS), which provides cryptographic authentication and encryption between endpoints at the transport layer. As of 2021, TLS 1.3 is the current recommended version; NIST SP 800-52, Rev. 2 guidelines for TLS implementation explicitly deprecate TLS 1.0 and TLS 1.1 for federal systems, citing known vulnerabilities including POODLE and BEAST.

The mechanism sequence for TLS-protected transmission proceeds through discrete phases:

1. Handshake — Client and server negotiate cipher suites, exchange certificates, and authenticate identities using asymmetric cryptography (RSA or ECDSA key exchange)
2. Key derivation — Session keys are derived from the handshake exchange; TLS 1.3 enforces forward secrecy by default, meaning compromise of a long-term key does not expose past session data
3. Bulk encryption — Application data is encrypted using a symmetric cipher, typically AES-256-GCM or ChaCha20-Poly1305
4. Integrity verification — Message Authentication Codes (MACs) or authenticated encryption schemes verify that data has not been altered in transit
5. Session termination — Cryptographic closure alerts prevent truncation attacks

Beyond TLS, IPsec operates at the network layer and secures traffic between network segments rather than individual application sessions. IPsec is commonly applied in VPN architectures and site-to-site connections. The contrast between TLS and IPsec is a classification boundary with operational significance: TLS secures application-to-application flows, while IPsec secures host-to-host or network-to-network tunnels regardless of application protocol.

SSH (Secure Shell) provides encrypted channel security for administrative access and file transfer, governed by RFC 4253, and is distinct from both TLS and IPsec in that it is predominantly used for interactive sessions and automated data pipeline transfers rather than general web traffic.

Common scenarios

Healthcare data exchange — Electronic health record systems transmitting PHI between provider networks and payer systems must satisfy HIPAA Security Rule transmission standards. HL7 FHIR APIs used for interoperability operate over HTTPS (TLS-secured HTTP), and the Office of the National Coordinator for Health Information Technology (ONC) has issued interoperability rules requiring certified API technology to implement TLS at the transport layer.

Financial services — Payment processors transmitting cardholder data across merchant networks, acquirers, and card brands must satisfy PCI DSS Requirement 4.2.1, which specifies that strong cryptography and secure protocols be implemented for cardholder data in transit. The NYDFS Cybersecurity Regulation, 23 NYCRR 500, requires covered financial institutions to encrypt nonpublic information in transit over external networks.

Federal information systems — Agencies operating systems under FISMA must apply FIPS-validated cryptography for data in transit, as mandated by FIPS 140-3. Cloud services hosting federal data must satisfy FedRAMP requirements, which incorporate SC-8 controls with specific parameter settings for transmission protection under the FedRAMP Authorization Framework.

Internal network traffic — A common oversight is treating internal east-west traffic — traffic moving between servers within a data center — as exempt from encryption requirements. Zero trust architecture frameworks, including NIST SP 800-207, reject implicit trust on internal network segments and specify that even lateral traffic should be authenticated and encrypted. The scope of transmission security controls within an organization's environment is addressed in the reference.

Decision boundaries

Selecting appropriate transit controls depends on four structural factors: the sensitivity classification of the data, the network path the data traverses, the application protocol in use, and applicable regulatory mandates.

TLS vs. IPsec selection — TLS is appropriate when the security requirement is per-application or per-session and the endpoint operates at the application layer. IPsec is appropriate when the requirement is network-level encryption between defined network segments, particularly where multiple protocols or non-HTTP application traffic traverse a shared connection.

Protocol version enforcement — TLS 1.2 remains widely deployed; TLS 1.3 is required for new federal system implementations under NIST SP 800-52 Rev. 2 and provides measurable improvements in handshake latency and forward secrecy. Legacy systems still operating TLS 1.1 or below present a compliance gap under NIST guidelines and represent an active vulnerability class.

Certificate management scope — Public key infrastructure (PKI) decisions determine the trust anchor for authentication. Public certificates issued by certificate authorities in the Web PKI (governed by CA/Browser Forum Baseline Requirements) are appropriate for externally facing services. Internal PKI, managed through enterprise certificate authorities, is appropriate for internal service-to-service authentication. Mixing these trust models without policy controls creates certificate validation gaps.

Regulatory floor vs. operational ceiling — Regulatory standards establish minimum controls: HIPAA does not specify cipher suites; PCI DSS specifies prohibition of weak protocols; NIST specifies FIPS-validated modules for federal systems. Organizations may implement controls above these floors — for example, enforcing mutual TLS (mTLS) for internal API communications even where no regulation requires it. The How to Use This Data Security Resource page describes how compliance obligations and technical control frameworks intersect across this reference network.

Key contrast: encryption in transit vs. encryption at rest — Encryption in transit protects data moving between boundaries; encryption at rest protects data stored on a medium. A data pipeline that decrypts data at an intermediate processing node and re-encrypts before storage has a gap window at that node — a known attack surface addressed by tokenization architectures and hardware security modules (HSMs) in high-sensitivity environments.