FDD urges data-layer controls in federal procurement assessments

The Foundation for Defense of Democracies (FDD) is pushing a paper from its Transformative Cyber Innovation Lab that calls for federal procurement assessments to add data-layer controls to the checklist. The argument, laid out Oct. 22 by FDD's Georgianna Shea, Sydney Johnson, and Cason Smith, is that encryption, access control, monitoring, zero trust, and post-quantum migration remain essential but do not fully govern what happens to sensitive data once it's decrypted, copied, shared, exfiltrated, or ingested into AI workflows.

The proposed fix is procurement language requiring vendors to pseudonymize sensitive data with false values, lowering what the data is worth if a breach happens. The paper wants that pseudonymization to be vaultless, meaning no central database holding the original value sets beside the substitutes, and keyless, meaning it doesn't depend on one conventional stored encryption key to unlock the protected values. "The policy question is...not whether encryption still matters. It does," the paper says. "The question is how to continue to safeguard sensitive information after encryption and perimeter controls no longer fully protect it."

FDD's ask extends past the procurement clause itself. The group wants NIST to commission an independent cryptanalytic review of the transformation architecture behind the pseudonymized dataset, while NSA runs a parallel classified review for national security use cases. NIST should also publish guidance so organizations have "a clear way to evaluate whether these systems protect data as claimed," defining minimum security properties, evidence, controls over restoration, audit records, and tests for a vendor's claims. The National Cybersecurity Center of Excellence would build example architectures and use cases.

The paper says agencies today are "apt to ignore this kind of technology simply because it does not fit neatly into existing categories" like encryption, tokenization, de-identification, or access control. Its answer isn't a new category for every emerging technology, but a consistent rubric for evaluating what the technology does and what risks it reduces. The procurement questions FDD would have agencies ask are concrete: whether raw data enters the vendor's infrastructure, whether token-to-source mapping exists, how reconstruction authority is stored, what independent validation the product satisfies, what audit evidence it produces, and what limits apply to the vendor's security claims.