V-38756

Discussion

If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. AES encryption with appropriate key lengths provides assurance that the cryptography is adequate.

Check Content

Navigate to "Options -> Security -> Encryption" and ensure it states: "Personal data and files are encrypted" and cannot be disabled. Otherwise, this is a finding.