Encryption at rest applies cryptographic protection to data while it is stored on disk, in databases, or in backups. AES-256 is the prevailing standard for legal and healthcare data.
Its effectiveness depends on key management, since encryption provides no protection if keys are stored alongside the data or accessible to the same compromised account.
Alternative Names:
Data-at-Rest Encryption, Storage Encryption
Why it Matters?
Encryption at rest is table stakes in any legal technology security questionnaire and appears in most outside counsel guidelines. The question worth asking beyond whether it exists is who holds the keys, because vendor-managed keys mean the vendor can decrypt client data, which matters for confidentiality analysis and for responding to third-party legal process served on the vendor.
Frequently Confused with
Related terms
Frequently asked questions
Does encryption at rest satisfy breach notification safe harbors?
Who should hold the encryption keys?
