STIGhub
STIGs
RMF Controls
Compare
← SC-28 — Protection of Information at Rest
CCI-001199
Definition
Protects the confidentiality and/or integrity of organization-defined information at rest.
Parent Control
SC-28
Protection of Information at Rest
System and Communications Protection
Linked STIG Checks (174)
V-204679
CAT I
AAA Services must be configured to protect the confidentiality and integrity of all information at rest.
AAA Services Security Requirements Guide
V-279070
CAT II
ColdFusion must be configured to support integration with a third-party Security Information and Event Management (SIEM) to support notifications.
Adobe ColdFusion Security Technical Implementation Guide
V-279129
CAT II
ColdFusion must not install the Performance Monitoring Toolset (PMT) Agent Package.
Adobe ColdFusion Security Technical Implementation Guide
V-273994
CAT I
Amazon Linux 2023 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
Amazon Linux 2023 Security Technical Implementation Guide
V-268144
CAT I
NixOS must protect the confidentiality and integrity of all information at rest.
Anduril NixOS Security Technical Implementation Guide
V-254606
CAT I
Apple iOS/iPadOS 16 must require a valid password be successfully entered before the mobile device data is unencrypted.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254607
CAT III
Apple iOS/iPadOS 16 must implement the management setting: limit Ad Tracking.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-254635
CAT III
The Apple iOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.
Apple iOS-iPadOS 16 Security Technical Implementation Guide
V-257120
CAT I
Apple iOS/iPadOS 16 must require a valid password be successfully entered before the mobile device data is unencrypted.
Apple iOS/iPadOS 16 BYOAD Security Technical Implementation Guide
V-257132
CAT III
The Apple iOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.
Apple iOS/iPadOS 16 BYOAD Security Technical Implementation Guide
V-259778
CAT I
Apple iOS/iPadOS 17 must require a valid password be successfully entered before the mobile device data is unencrypted.
Apple iOS/iPadOS 17 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-259791
CAT III
The Apple iOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.
Apple iOS/iPadOS 17 MDFPP 3.3 BYOAD Security Technical Implementation Guide
V-258338
CAT I
Apple iOS/iPadOS 17 must require a valid password be successfully entered before the mobile device data is unencrypted.
Apple iOS/iPadOS 17 Security Technical Implementation Guide
V-258339
CAT III
Apple iOS/iPadOS 17 must implement the management setting: limit Ad Tracking.
Apple iOS/iPadOS 17 Security Technical Implementation Guide
V-258369
CAT III
The Apple iOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.
Apple iOS/iPadOS 17 Security Technical Implementation Guide
V-268024
CAT I
Apple iOS/iPadOS 18 must require a valid password be successfully entered before the mobile device data is unencrypted.
Apple iOS/iPadOS 18 Security Technical Implementation Guide
V-268026
CAT III
Apple iOS/iPadOS 18 must implement the management setting: limit Ad Tracking.
Apple iOS/iPadOS 18 Security Technical Implementation Guide
V-268057
CAT III
The Apple iOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.
Apple iOS/iPadOS 18 Security Technical Implementation Guide
V-278784
CAT I
Apple iOS/iPadOS 26 must require a valid password be successfully entered before the mobile device data is unencrypted.
Apple iOS/iPadOS 26 Security Technical Implementation Guide
V-278786
CAT III
Apple iOS/iPadOS 26 must implement the management setting: limit Ad Tracking.
Apple iOS/iPadOS 26 Security Technical Implementation Guide
V-278816
CAT III
The Apple iOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.
Apple iOS/iPadOS 26 Security Technical Implementation Guide
V-252535
CAT II
The macOS system must implement cryptographic mechanisms to protect the confidentiality and integrity of all information at rest.
Apple macOS 12 (Monterey) Security Technical Implementation Guide
V-257241
CAT I
The macOS system must implement cryptographic mechanisms to protect the confidentiality and integrity of all information at rest.
Apple macOS 13 (Ventura) Security Technical Implementation Guide
V-259561
CAT I
The macOS system must enforce FileVault.
Apple macOS 14 (Sonoma) Security Technical Implementation Guide
V-268556
CAT I
The macOS system must enforce FileVault.
Apple macOS 15 (Sequoia) Security Technical Implementation Guide
V-277166
CAT I
The macOS system must enforce FileVault.
Apple macOS 26 (Tahoe) Security Technical Implementation Guide
V-276392
CAT I
Apple visionOS 2 must require a valid password be successfully entered before the mobile device data is unencrypted.
Apple visionOS 2 Security Technical Implementation Guide
V-276408
CAT III
The Apple visionOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.
Apple visionOS 2 Security Technical Implementation Guide
V-282801
CAT I
Apple visionOS 26 must require a valid password be successfully entered before the mobile device data is unencrypted.
Apple visionOS 26 Security Technical Implementation Guide
V-282818
CAT III
The Apple visionOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.
Apple visionOS 26 Security Technical Implementation Guide
V-274606
CAT II
The API implementation must use FIPS-validated encryption and hashing algorithms to protect the confidentiality and integrity of API keys.
Application Programming Interface (API) Security Requirements Guide
V-274607
CAT I
The API must encrypt sensitive cached data.
Application Programming Interface (API) Security Requirements Guide
V-222587
CAT II
The application must protect the confidentiality and integrity of stored information when required by DOD policy or the information owner.
Application Security and Development Security Technical Implementation Guide
V-204770
CAT II
The application server must protect the confidentiality and integrity of all information at rest.
Application Server Security Requirements Guide
V-204771
CAT II
The application server must employ cryptographic mechanisms to ensure confidentiality and integrity of all information at rest when stored off-line.
Application Server Security Requirements Guide
V-237331
CAT I
The ArcGIS Server must use a full disk encryption solution to protect the confidentiality and integrity of all information.
ArcGIS for Server 10.3 Security Technical Implementation Guide
V-272427
CAT II
Permissions assigned to the DNSSEC keys used with the BIND 9.x implementation must enforce read-only access to the key owner and deny access to all other users.
BIND 9.x Security Technical Implementation Guide
V-272428
CAT II
The DNSSEC keys used with the BIND 9.x implementation must be owned by a privileged account.
BIND 9.x Security Technical Implementation Guide
V-272429
CAT II
The DNSSEC keys used with the BIND 9.x implementation must be group owned by a privileged account.
BIND 9.x Security Technical Implementation Guide
V-219150
CAT II
Ubuntu operating systems handling data requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238335
CAT II
Ubuntu operating systems handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260484
CAT II
Ubuntu 22.04 LTS must implement cryptographic mechanisms to prevent unauthorized disclosure and modification of all information that requires protection at rest.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270747
CAT II
Ubuntu 24.04 LTS handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-242659
CAT I
The Cisco ISE must only allow authorized administrators to view or change the device configuration, system files, and other files stored.
Cisco ISE NDM Security Technical Implementation Guide
V-269429
CAT I
AlmaLinux OS 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-233586
CAT I
PostgreSQL must protect the confidentiality and integrity of all information at rest.
Crunchy Data PostgreSQL Security Technical Implementation Guide
V-261901
CAT I
PostgreSQL must protect the confidentiality and integrity of all information at rest.
Crunchy Data Postgres 16 Security Technical Implementation Guide
V-206570
CAT I
The DBMS must protect the confidentiality and integrity of all information at rest.
Database Security Requirements Guide
V-235777
CAT I
FIPS mode must be enabled on all Docker Engine - Enterprise nodes.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-235826
CAT II
Docker Secrets must be used to store configuration files and small amounts of user-generated data (up to 500 kb in size) in Docker Enterprise.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-205187
CAT II
The DNS server implementation must protect the confidentiality and integrity of secret/private cryptographic keys at rest and the integrity of DNS information at rest.
Domain Name System (DNS) Security Requirements Guide
V-270978
CAT II
Dragos must use FIPS-validated encryption and hashing algorithms to protect the confidentiality and integrity of application configuration files and user-generated data stored or aggregated on the device.
Dragos Platform 2.x Security Technical Implementation Guide
V-224178
CAT I
The EDB Postgres Advanced Server must protect the confidentiality and integrity of all information at rest.
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
V-213604
CAT I
The EDB Postgres Advanced Server must protect the confidentiality and integrity of all information at rest.
EDB Postgres Advanced Server v9.6 Security Technical Implementation Guide
V-259259
CAT I
The EDB Postgres Advanced Server must protect the confidentiality and integrity of all information at rest.
EnterpriseDB Postgres Advanced Server (EPAS) Security Technical Implementation Guide
V-278405
CAT II
NGINX must be configured to use FIPS-approved algorithms to protect the confidentiality and integrity of transmitted information.
F5 NGINX Security Technical Implementation Guide
V-255626
CAT II
CounterACT must allow only authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media.
ForeScout CounterACT NDM Security Technical Implementation Guide
V-230971
CAT I
Forescout must only allow authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media (such as a flash drive).
Forescout Network Device Management Security Technical Implementation Guide
V-234216
CAT I
The FortiGate device must only allow authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media (such as a flash drive).
Fortinet FortiGate Firewall NDM Security Technical Implementation Guide
V-203661
CAT II
The operating system must protect the confidentiality and integrity of all information at rest.
General Purpose Operating System Security Requirements Guide
V-221581
CAT II
Browser history must be saved.
Google Chrome Current Windows Security Technical Implementation Guide
V-283027
CAT II
The HPE Alletra Storage ArcusOS device must implement cryptographic mechanisms to prevent unauthorized disclosure and modification of all information at rest on all system components.
HPE Alletra Storage ArcusOS Web Server Security Technical Implementation Guide
V-215207
CAT II
AIX must protect the confidentiality and integrity of all information at rest.
IBM AIX 7.x Security Technical Implementation Guide
V-252591
CAT II
IBM Aspera Faspex must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-252608
CAT II
IBM Aspera Shares must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-213706
CAT II
DB2 must protect the confidentiality and integrity of all information at rest.
IBM DB2 V10.5 LUW Security Technical Implementation Guide
V-255776
CAT II
The MQ Appliance messaging server must implement cryptography mechanisms to protect the integrity of the remote access session.
IBM MQ Appliance V9.0 AS Security Technical Implementation Guide
V-223512
CAT II
ACF2 SECVOLS GSO record value must be set to VOLMASK(). Any local changes are justified and documented with the ISSO.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223513
CAT II
ACF2 RESVOLS GSO record value must be set to Volmask(-). Any other setting requires documentation justifying the change.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223569
CAT I
The IBM z/OS systems requiring data at rest protection must properly employ IBM DS8880 or equivalent hardware solutions for full disk encryption.
IBM z/OS ACF2 Security Technical Implementation Guide
V-223788
CAT I
The IBM z/OS systems requiring data-at-rest protection must properly employ IBM DS8880 or equivalent hardware solutions for full disk encryption.
IBM z/OS RACF Security Technical Implementation Guide
V-251108
CAT I
The IBM z/OS systems requiring data at rest protection must properly employ IBM DS8880 or equivalent hardware solutions for full disk encryption.
IBM z/OS TSS Security Technical Implementation Guide
V-237928
CAT II
IBM z/VM tapes must use Tape Encryption.
IBM zVM Using CA VM:Secure Security Technical Implementation Guide
V-258600
CAT I
The ICS must be configured to prevent nonprivileged users from executing privileged functions.
Ivanti Connect Secure NDM Security Technical Implementation Guide
V-213536
CAT II
JBoss file permissions must be configured to protect the confidentiality and integrity of application files.
JBoss Enterprise Application Platform 6.3 Security Technical Implementation Guide
V-253914
CAT I
The Juniper device must be configured to only allow authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media (such as a flash drive).
Juniper EX Series Switches Network Device Management Security Technical Implementation Guide
V-213774
CAT II
SQL Server must protect data at rest and ensure confidentiality and integrity of data.
MS SQL Server 2014 Database Security Technical Implementation Guide
V-213779
CAT II
The Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified.
MS SQL Server 2014 Database Security Technical Implementation Guide
V-213780
CAT II
Database Master Key passwords must not be stored in credentials within the database.
MS SQL Server 2014 Database Security Technical Implementation Guide
V-213781
CAT II
Symmetric keys (other than the database master key) must use a DoD certificate to encrypt the key.
MS SQL Server 2014 Database Security Technical Implementation Guide
V-213857
CAT II
The Service Master Key must be backed up, stored offline and off-site.
MS SQL Server 2014 Instance Security Technical Implementation Guide
V-213911
CAT II
The Database Master Key encryption password must meet DOD password complexity requirements.
MS SQL Server 2016 Database Security Technical Implementation Guide
V-213912
CAT II
The Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified.
MS SQL Server 2016 Database Security Technical Implementation Guide
V-213913
CAT II
The Certificate used for encryption must be backed up and stored in a secure location that is not on the SQL Server.
MS SQL Server 2016 Database Security Technical Implementation Guide
V-213972
CAT I
SQL Server must protect the confidentiality and integrity of all information at rest.
MS SQL Server 2016 Instance Security Technical Implementation Guide
V-213973
CAT II
The Service Master Key must be backed up and stored in a secure location that is not on the SQL Server.
MS SQL Server 2016 Instance Security Technical Implementation Guide
V-213974
CAT II
The Master Key must be backed up and stored in a secure location that is not on the SQL Server.
MS SQL Server 2016 Instance Security Technical Implementation Guide
V-205520
CAT II
The Mainframe Product must protect the confidentiality and integrity of all information at rest.
Mainframe Product Security Requirements Guide
V-253710
CAT I
MariaDB must protect the confidentiality and integrity of all information at rest.
MariaDB Enterprise 10.x Security Technical Implementation Guide
V-220372
CAT I
MarkLogic Server must protect the confidentiality and integrity of all information at rest.
MarkLogic Server v9 Security Technical Implementation Guide
V-255339
CAT I
Azure SQL Database must protect the confidentiality and integrity of all information at rest.
Microsoft Azure SQL Database Security Technical Implementation Guide
V-276251
CAT I
Azure SQL Managed Instance must protect the confidentiality and integrity of all information at rest.
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V-276287
CAT II
The database master key (DMK) encryption password for Azure SQL Server Managed Instance must meet DOD password complexity requirements.
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V-276288
CAT II
The database master key (DMK) for Azure SQL Server Managed Instance must be encrypted by the service master key (SMK), where a DMK is required and another encryption method has not been specified.
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V-276289
CAT II
The Certificate used for encryption for Azure SQL Managed Instance must be backed up, stored offline and off-site.
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
V-228376
CAT II
Exchange Mailboxes must be retained until backups are complete.
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide
V-228377
CAT II
Exchange email forwarding must be restricted.
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide
V-228378
CAT II
Exchange email-forwarding SMTP domains must be restricted.
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide
V-259671
CAT II
Exchange mailboxes must be retained until backups are complete.
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
V-259672
CAT II
Exchange email forwarding must be restricted.
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
V-259673
CAT II
Exchange email-forwarding SMTP domains must be restricted.
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
V-218807
CAT II
The production IIS 10.0 web server must utilize SHA2 encryption for the Machine Key.
Microsoft IIS 10.0 Server Security Technical Implementation Guide
V-223025
CAT II
Userdata persistence must be disallowed (Internet zone).
Microsoft Internet Explorer 11 Security Technical Implementation Guide
V-223067
CAT II
Userdata persistence must be disallowed (Restricted Sites zone).
Microsoft Internet Explorer 11 Security Technical Implementation Guide
V-223291
CAT II
Office applications must be configured to specify encryption type in password-protected Office 97-2003 files.
Microsoft Office 365 ProPlus Security Technical Implementation Guide
V-223292
CAT II
Office applications must be configured to specify encryption type in password-protected Office Open XML files.
Microsoft Office 365 ProPlus Security Technical Implementation Guide
V-238027
CAT II
Document metadata for password protected files must be protected.
Microsoft Office System 2016 Security Technical Implementation Guide
V-238028
CAT II
The encryption type for password protected Open XML files must be set.
Microsoft Office System 2016 Security Technical Implementation Guide
V-238029
CAT II
The encryption type for password protected Office 97 thru Office 2003 must be set.
Microsoft Office System 2016 Security Technical Implementation Guide
V-271169
CAT II
The Database Master Key encryption password must meet DOD password complexity requirements.
Microsoft SQL Server 2022 Database Security Technical Implementation Guide
V-271170
CAT II
The Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified.
Microsoft SQL Server 2022 Database Security Technical Implementation Guide
V-271171
CAT II
The certificate used for encryption must be backed up and stored in a secure location that is not on the SQL Server.
Microsoft SQL Server 2022 Database Security Technical Implementation Guide
V-271322
CAT I
The Master Key must be backed up and stored in a secure location that is not on the SQL Server.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-271323
CAT I
The Service Master Key must be backed up and stored in a secure location that is not on the SQL Server.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-271324
CAT I
SQL Server must protect the confidentiality and integrity of all information at rest.
Microsoft SQL Server 2022 Instance Security Technical Implementation Guide
V-220702
CAT I
Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.
Microsoft Windows 10 Security Technical Implementation Guide
V-220703
CAT I
Windows 10 systems must use a BitLocker PIN for pre-boot authentication.
Microsoft Windows 10 Security Technical Implementation Guide
V-220704
CAT I
Windows 10 systems must use a BitLocker PIN with a minimum length of six digits for pre-boot authentication.
Microsoft Windows 10 Security Technical Implementation Guide
V-220738
CAT II
Windows 10 nonpersistent VM sessions must not exceed 24 hours.
Microsoft Windows 10 Security Technical Implementation Guide
V-253295
CAT II
Windows 11 nonpersistent VM sessions must not exceed 24 hours.
Microsoft Windows 11 Security Technical Implementation Guide
V-215630
CAT II
The Windows 2012 DNS Server must protect secret/private cryptographic keys while at rest.
Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide
V-224843
CAT I
Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
Microsoft Windows Server 2016 Security Technical Implementation Guide
V-205727
CAT I
Windows Server 2019 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
Microsoft Windows Server 2019 Security Technical Implementation Guide
V-254262
CAT I
Windows Server 2022 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
Microsoft Windows Server 2022 Security Technical Implementation Guide
V-278009
CAT II
Windows Server 2025 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
Microsoft Windows Server 2025 Security Technical Implementation Guide
V-259393
CAT II
The Windows DNS Server must protect secret/private cryptographic keys while at rest.
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide
V-221178
CAT I
MongoDB must protect the confidentiality and integrity of all information at rest.
MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide
V-252165
CAT I
MongoDB must protect the confidentiality and integrity of all information at rest.
MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
V-265926
CAT I
MongoDB must protect the confidentiality and integrity of all information at rest.
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
V-279361
CAT I
MongoDB must protect the confidentiality and integrity of all information at rest.
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
V-246927
CAT I
ONTAP must enforce administrator privileges based on their defined roles.
NetApp ONTAP DSC 9.x Security Technical Implementation Guide
V-202078
CAT I
The network device must only allow authorized administrators to view or change the device configuration, system files, and other files stored either in the device or on removable media (such as a flash drive).
Network Device Management Security Requirements Guide
V-254115
CAT I
Nutanix AOS must protect the confidentiality and integrity of all information at rest.
Nutanix AOS 5.20.x Application Security Technical Implementation Guide
V-279446
CAT II
Nutanix AOS must protect the confidentiality and integrity of all information at rest.
Nutanix Acropolis Application Server Security Technical Implementation Guide
V-279447
CAT II
Nutanix AOS must employ cryptographic mechanisms to ensure confidentiality and integrity of all information at rest when stored offline.
Nutanix Acropolis Application Server Security Technical Implementation Guide
V-279621
CAT I
Nutanix OS must protect the confidentiality and integrity of all information at rest.
Nutanix Acropolis GPOS Security Technical Implementation Guide
V-219781
CAT II
The DBMS must take needed steps to protect data at rest and ensure confidentiality and integrity of application data.
Oracle Database 11.2g Security Technical Implementation Guide
V-220297
CAT I
The DBMS must take needed steps to protect data at rest and ensure confidentiality and integrity of application data.
Oracle Database 12c Security Technical Implementation Guide
V-270574
CAT I
Oracle Database must take steps to protect data at rest and ensure confidentiality and integrity of application data.
Oracle Database 19c Security Technical Implementation Guide
V-221758
CAT I
The Oracle Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Oracle Linux 7 Security Technical Implementation Guide
V-248525
CAT I
All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection.
Oracle Linux 8 Security Technical Implementation Guide
V-271756
CAT I
OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
Oracle Linux 9 Security Technical Implementation Guide
V-235155
CAT I
The MySQL Database Server 8.0 must protect the confidentiality and integrity of all information at rest.
Oracle MySQL 8.0 Security Technical Implementation Guide
V-214120
CAT I
PostgreSQL must protect the confidentiality and integrity of all information at rest.
PostgreSQL 9.x Security Technical Implementation Guide
V-280935
CAT I
RHEL 10 must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information on local disk partitions that requires at-rest protection.
Red Hat Enterprise Linux 10 Security Technical Implementation Guide
V-204497
CAT I
The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Red Hat Enterprise Linux 7 Security Technical Implementation Guide
V-230224
CAT I
All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
Red Hat Enterprise Linux 8 Security Technical Implementation Guide
V-257879
CAT I
RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
Red Hat Enterprise Linux 9 Security Technical Implementation Guide
V-251242
CAT I
Redis Enterprise DBMS must protect the confidentiality and integrity of all information at rest.
Redis Enterprise 6.x Security Technical Implementation Guide
V-275578
CAT II
Ubuntu OS must implement cryptographic mechanisms to prevent unauthorized disclosure and modification of all information that requires protection at rest.
Riverbed NetIM OS Security Technical Implementation Guide
V-261284
CAT I
All SLEM 5 persistent disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection.
SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide
V-217146
CAT I
All SUSE operating system persistent disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
SUSE Linux Enterprise Server 12 Security Technical Implementation Guide
V-276545
CAT I
Samsung Android must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled.
Samsung Android 16 COBO Security Technical Implementation Guide
V-276652
CAT I
Samsung Android must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled.
Samsung Android 16 COPE Security Technical Implementation Guide
V-255119
CAT I
Samsung Android must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled.
Samsung Android OS 13 with Knox 3.x COBO Security Technical Implementation Guide
V-255148
CAT I
Samsung Android must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled.
Samsung Android OS 13 with Knox 3.x COPE Security Technical Implementation Guide
V-258638
CAT I
Samsung Android must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled.
Samsung Android OS 14 with Knox 3.x COBO Security Technical Implementation Guide
V-258674
CAT I
Samsung Android must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled.
Samsung Android OS 14 with Knox 3.x COPE Security Technical Implementation Guide
V-268935
CAT I
Samsung Android must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled.
Samsung Android OS 15 with Knox 3.x COBO Security Technical Implementation Guide
V-269034
CAT I
Samsung Android must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled.
Samsung Android OS 15 with Knox 3.x COPE Security Technical Implementation Guide
V-216413
CAT III
The operating system must protect the confidentiality and integrity of information at rest.
Solaris 11 SPARC Security Technical Implementation Guide
V-216176
CAT III
The operating system must protect the confidentiality and integrity of information at rest.
Solaris 11 X86 Security Technical Implementation Guide
V-279251
CAT I
The Edge SWG must be configured to use at least two authentication servers for the purpose of authenticating users prior to granting administrative access.
Symantec Edge SWG NDM Security Technical Implementation Guide
V-254853
CAT II
The Tanium Operating System (TanOS) must use FIPS-validated encryption and hashing algorithms to protect the confidentiality and integrity of operating system configuration and user-generated data stored on the host.
Tanium 7.x Operating System on TanOS Security Technical Implementation Guide
V-253085
CAT II
All TOSS local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
Tri-Lab Operating System Stack (TOSS) 4 Security Technical Implementation Guide
V-282514
CAT I
TOSS 5 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.
Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide
V-265292
CAT I
The NSX Manager must assign users/accounts to organization-defined roles configured with approved authorizations.
VMware NSX 4.x Manager NDM Security Technical Implementation Guide
V-256331
CAT I
The vCenter Server must enable FIPS-validated cryptography.
VMware vSphere 7.0 vCenter Security Technical Implementation Guide
V-258917
CAT I
The vCenter Server must enable FIPS-validated cryptography.
VMware vSphere 8.0 vCenter Security Technical Implementation Guide
V-207407
CAT II
The VMM must protect the confidentiality and integrity of all information at rest.
Virtual Machine Manager Security Requirements Guide
V-206407
CAT II
Information at rest must be encrypted using a DOD-accepted algorithm to protect the confidentiality and integrity of the information.
Web Server Security Requirements Guide
V-73273
CAT II
Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
Windows Server 2016 Security Technical Implementation Guide
V-73273
CAT II
Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
Windows Server 2016 Security Technical Implementation Guide
V-93515
CAT II
Windows Server 2019 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
Windows Server 2019 Security Technical Implementation Guide