AO coverage. Addresses the single Data At Rest objective for every location where CUI is authorized to reside.

Locations enumerated. The control is only as good as the list, so the list is explicit: managed endpoint disks, the enclave SharePoint Online site collection, the Azure Storage account holding CAD and simulation output, the lab NAS volume, the backup repository and its offsite copy, and the two databases behind the MRP integration. Any other location is an unauthorized location, which is what DLP and the labeling policy are for.

Endpoints. BitLocker with XTS-AES is required by compliance policy, enforced through MDM, with recovery keys escrowed to the directory. A device that reports unencrypted loses CUI access through Conditional Access rather than sitting on a report waiting for someone to notice. Suspending BitLocker requires a ticket and re-enables automatically after the maintenance window.

Cloud storage. The enclave storage account uses service-side encryption with a customer-managed key held in the HSM-backed vault, so key revocation is a usable containment action. SharePoint Online relies on service encryption plus sensitivity labels that carry their own protection with the file. Infrastructure encryption is enabled on the storage account where the workload supports it.

On-prem and backup. The lab NAS uses volume encryption with its key in the vault rather than on the appliance. Backups are encrypted at the repository with a key that is not stored alongside the backup data, and the offsite copy is encrypted before it leaves. The restore runbook includes retrieving the key from escrow, which is tested rather than assumed.

Databases. Transparent database encryption is enabled, and the columns holding the most sensitive fields carry application-level encryption so a database file copy is not sufficient to read them.

Maintenance. Weekly compliance report of unencrypted or encryption-suspended devices, with anything over three days becoming a ticket. Quarterly reconciliation of the authorized-location list against actual storage inventory, since new storage accounts and shares are how unencrypted copies appear. Annual restore test that exercises key retrieval from escrow.

Accepted gap. One CNC controller writes toolpath files to an internal disk that cannot run organizational encryption. It is air-gapped, physically secured in the machine cell, holds only derived toolpaths rather than source CUI drawings, and is always physically destroyed at end of life under the sanitization SOP.

• Written list of authorized CUI-at-rest locations with the encryption mechanism for each
• BitLocker / MDM policy export and the compliance report showing encryption state
• Storage account configuration showing customer-managed key and infrastructure encryption
• Backup repository encryption settings and a completed restore test including key retrieval
• Exception record for the CNC controller with its physical and destruction controls