Encryption at Rest
What is Encryption at Rest?
The encryption of data while it is stored on disk, database, or other storage media to protect it from unauthorized access if the storage is compromised.
Terms that appear alongside encryption at rest
Each of these is named in at least one of the same controls as encryption at rest. The number is how many controls name both.
- encryption 35 shared controls
- audit 18 shared controls
- nist 13 shared controls
- key management 13 shared controls
- breach notification 13 shared controls
- access control 12 shared controls
- integrity 11 shared controls
- pseudonymisation 10 shared controls
Frameworks that govern encryption at rest
What the standards actually require on encryption at rest
Requirements naming encryption at rest across 6 standards, quoted from the control text.
DSPs encrypt data stored for tax, accounting, payroll, business registry and superannuation transactions, including personally identifiable information, at the disk, container, application or database level, or by partial encryption at block, field or column l...
ato-digital-service-provider-dsp-operational-security-framework::SEC.EAR · Encryption at rest of in-scope data, or the four compensating controls →Ensure all data stores encrypt data at rest using KMS keys, enforce by default through account settings, SCPs and Config rules.
SEC08-BP02 · Enforce encryption at rest →Full disk encryption, or partial encryption where access controls will only allow writing to the encrypted partition, is implemented when encrypting data at rest.
ISM-0459 · Full disk or partial encryption at rest →ISMAP Data Protection establishes comprehensive data lifecycle controls. (1) Data Classification: customer government data must be classified per Japanese government data classification scheme + including (a) General + (b) Sensitive + (c) Confidential + (d) St...
ISMAP-DataProtection-Classification-Encryption-DataResidencyJapan-Backup-SecureDeletion-Cryptography-FIPS · ISMAP Data Protection - Data Classification + AES-256 Encryption At Rest + TLS 1.3 In Transit + Data Residency Japan + Backup + Secure Deletion + Cryptography per FIPS 140-3 + CRYPTREC + KMS HSM →Security Dimensions 4 and 5 per X.805 Clauses 6.4 and 6.5 are closely related: (1) Data Confidentiality (Dim 4) protects data from unauthorized disclosure - so that anyone without authorization is unable to make sense of the content.
X805-Dim4-5-Data-Confidentiality-Communication-Security-Encryption-Information-Flow-Protection · ITU-T X.805 Security Dimensions 4-5 - Data Confidentiality + Communication Security + Encryption At-Rest + In-Transit + In-Use + Information Flow Protection + Steered Communication + Anti-Tap + Anti-Eavesdrop + Post-Quantum Cryptography →Object storage should be secured through its access model: authenticated and authorized API access, bucket and object policies reviewed against exposure, versioning, immutability and retention features used for protection and compliance, encryption at rest and...
iso-iec-27040-2024::10.12 · Object-based storage →Questions people ask about encryption at rest
What is Encryption at Rest?
Why is Encryption at Rest important for compliance?
Which compliance frameworks address Encryption at Rest?
Where can I learn more about Encryption at Rest?
See how Encryption at Rest applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.