Is the storage of sensitive data encrypted using security protocols/algorithms (e.g., disk encryption, at-rest, files, and within a running database)?

Encryption of data at rest is what reviewers are confirming here: whether sensitive stored data is protected using sound protocols and algorithms across disks, files, and running databases. Encryption at rest means that data is encrypted when it is stored on disk, in databases, or in other storage systems, as opposed to when it is being transmitted or actively processed.

The question specifically mentions several contexts where encryption should be applied:
- Disk encryption: Full-disk or volume-level encryption that protects all data on a storage device
- At-rest encryption: General term for encrypting stored data
- File encryption: Encrypting individual files or groups of files
- Database encryption: Encrypting data within a running database

This question is being asked in a security assessment because unencrypted sensitive data is vulnerable to unauthorized access if storage media is physically stolen, improperly decommissioned, or if an attacker gains access to the storage systems. Encryption adds a critical layer of protection by making the data unreadable without the proper decryption keys.

To best answer this question:

1. Identify all locations where sensitive data is stored in your environment
2. Document the encryption methods used for each storage location
3. Specify the encryption algorithms and key strengths (e.g., AES-256)
4. Mention any compliance standards the encryption methods adhere to (e.g., FIPS 140-2)
5. Describe key management practices
6. If any sensitive data is not encrypted, explain why and what compensating controls are in place