At-rest encryption is the protection of stored data by encrypting it so it cannot be read without the correct key. It applies to disks, databases, backups and object storage, and usually relies on key management, access controls and secure key rotation to limit exposure if storage media or snapshots are copied.
What At-Rest Encryption Protects
At-rest encryption protects stored data by making the contents unreadable without the correct key. Its value is greatest when disks, databases, backups or object storage can be copied, mounted or exposed outside the intended control boundary.
It does not prevent authorised access to the data by itself, but it materially raises the cost of theft, loss and offline inspection. If an attacker or insider obtains raw storage, encryption turns the problem from immediate disclosure into a key-management and access-control problem.
Where At-Rest Encryption Applies
At-rest encryption is used across several storage layers, and the right implementation depends on what is being protected. Full-disk and volume encryption protect entire systems, database encryption protects structured records, and object-storage encryption protects files, exports and snapshots that may live outside the primary application runtime.
In practice, organisations often combine multiple layers. A database may use transparent data encryption, while sensitive fields use application or column-level encryption, and backups are encrypted again before they leave the primary environment. That layered approach helps reduce exposure when data is copied, replicated or restored in another context.
Key Management and Control Boundaries
The security of at-rest encryption depends heavily on the key, not just the cipher. Key custody, rotation, separation of duties and access control determine who can actually decrypt the data, so weak key governance can leave encrypted storage effectively exposed.
Good implementations treat encryption keys as highly sensitive security material, with clear ownership, controlled access and defined lifecycle handling. Encryption Guide and Encryption Buyer's Guide are useful references for the relationship between storage encryption, key custody and design choices such as BYOK, HYOK and HSM-backed control.
Operational Trade-offs and Failure Conditions
At-rest encryption is strongest when it is paired with disciplined backup handling, snapshot controls and environment separation. If encrypted backups are widely copied, or if the same keys protect too many systems, the blast radius of a key compromise grows quickly. The same is true when encryption exists in policy but not on all storage paths that actually hold sensitive data.
Another common failure mode is assuming that encryption alone eliminates the need for access control. A user or service that can decrypt data still has meaningful access, so encryption must be aligned with least privilege, logging and recovery design. Database and Storage Encryption Guide and Encryption Policy Template help frame the operational decisions that make at-rest encryption durable rather than symbolic.
Risk and Threat Considerations
At-rest encryption reduces the impact of lost media, stolen snapshots and exposed backups, but it does not remove risk if keys, privileged decrypt paths or recovery systems are compromised. Attackers often target the weakest point around the encrypted data, not the cipher itself.
Failure mechanism: If storage is copied or mounted and the decryption keys are accessible through the same trust boundary, the attacker can recover plaintext without needing to defeat the encryption algorithm.
Impact: The result can be direct data disclosure, regulatory exposure, backup abuse and broader compromise of connected systems that reuse the same keys or control plane.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST SP 800-57, CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-28 — Protection of Information at Rest | Directly addresses encrypting stored information to limit disclosure from media or snapshot exposure. |
| Recommendation — Apply SC-28 to encrypt stored data wherever it resides and protect recovery media and backups. | ||
| NIST SP 800-57 | Part 1 — Key Management | At-rest encryption depends on key generation, storage, rotation and destruction for its security. |
| Recommendation — Manage encryption keys with controlled lifecycle, rotation and separation of duties. | ||
| ISO/IEC 27001:2022 | A.8.24 — Use of cryptography | Annex A explicitly covers cryptographic controls used to protect data at rest and manage keys. |
| Recommendation — Define cryptographic rules for stored data, including approved methods and key governance. | ||
| CIS Controls v8 | CIS-3 — Data Protection | CIS Control 3 covers encryption and protection of sensitive data across storage and backup paths. |
| Recommendation — Implement data protection safeguards that encrypt sensitive information and protect backups. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | CSF 2.0 explicitly requires data at rest to be protected as part of the Protect function. |
| Recommendation — Protect stored data with encryption and complementary access controls across all repositories. | ||
Practitioner Guidance
Why practitioners should care: Treat at-rest encryption as a storage protection control, not a complete data protection strategy. Its effectiveness depends on where keys live, who can use them, and whether every storage path that matters is actually covered.
What to watch for: Inconsistent coverage across databases, backups, object stores and snapshots is a strong warning sign, especially when storage is replicated across accounts, tenants or environments. Database and Storage Encryption Guide is a practical reference when you are checking whether encryption, rotation and monitoring are implemented as a coherent set.
Practitioner takeaway: The control is only as strong as the key lifecycle and the recovery path that supports it.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org