# Encryption at Rest

Record: `arch:encryption-at-rest`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory for sensitive data
Scope: storage, database, backups
Canonical: https://banes-lab.com/ontology#arch-encryption-at-rest

## Repair

- Refactored by: Enable Encryption, Add KMS
- Detected by: storage config scan
- Violated by: sensitive data stored unencrypted
- Measured by: encrypted storage coverage
- Enforced by: infrastructure policy

## requires

- [Key Management](https://banes-lab.com/records/lex/key-management.md)

## reinforces

- [Data Protection](https://banes-lab.com/records/lex/data-protection.md)

## enables

- [Confidentiality of Stored Data](https://banes-lab.com/records/lex/confidentiality-of-stored-data.md)

## conflicts-with

- [Plaintext Sensitive Storage](https://banes-lab.com/records/lex/plaintext-sensitive-storage.md)

## tensions-with

- [Key Operations](https://banes-lab.com/records/lex/key-operations.md)

## tensions

- [Encryption at Rest Key Operations](https://banes-lab.com/records/tension/encryption-at-rest-key-operations.md)