A device configured to receive a data storage request that identifies a data content type for a data element and a target data storage device. The device is further configured to determine the target data storage device does not match an approved data storage device. The device is further configured to determine a security level associated with the target data storage device and to determine vulnerability types associated with the determined security level of the target data storage device. The device is further configured to identify security controls based on the determined vulnerability types and to output the identified security controls. Each security control comprises a hardware configuration for data storage devices that are associated with mitigating one or more vulnerability types.