Home / Fast Track / Encryption in transit & at rest
Shared control area · counts toward 9 standards
Encryption in transit & at rest
This control area ensures that sensitive data is unreadable to unauthorized parties whether it is moving across networks or stored on disk. It is a universal requirement because encryption provides a critical layer of defense against data breaches resulting from intercepted traffic or stolen physical/virtual storage media.
Implement it once
- Enforce TLS 1.2 or higher for all data in transit, disabling outdated protocols like SSL and early TLS versions.
- Enable AES-256 (or equivalent) encryption at rest for all databases, block storage, and object storage buckets.
- Deploy a centralized Key Management Service (KMS) to automate key rotation and strictly control access permissions.
- Use a dedicated secrets management tool to encrypt API keys and passwords rather than storing them in plaintext configuration files.
- Standardize on encrypted communication channels for administrative access, such as SSH or HTTPS.
Evidence it produces
- Configuration screenshots or exports showing "Encryption Enabled" flags on cloud storage and database instances.
- TLS scan reports (e.g., Qualys SSL Labs) confirming the use of strong cipher suites and current certificates.
- Key management policy documents and system logs proving that keys are rotated according to a defined schedule.
- Infrastructure-as-Code (IaC) templates demonstrating that encryption is mandated by default for all new resources.
Where it counts
Implementing a unified encryption strategy satisfies the data protection requirements of nearly every major security framework, including SOC 2, ISO 27001, HIPAA, and PCI DSS. This allows an organization to provide a single set of evidence to multiple auditors regardless of the specific standard being assessed.