text: **12.1 Planning for encryption**
  
  Data-at-rest encryption is a powerful tool that can help organizations protect the 
  confidentiality of sensitive information. However, encryption, like any other tool, must be used 
  correctly to fulfill its purpose. 
  
  Multiple drivers exist for an organization to implement data-at-rest encryption. These can be 
  internal, such as protection of confidential company data, and ease of storage sanitization, or 
  external, such as compliance with legal requirements or contractual obligations. 
  
  Therefore, before configuring encryption on the storage, the organization defines its needs 
  and, if it is decided that data-at-rest encryption is required, includes it in the security policy. 
  Without defining the purpose of the particular implementation of data-at-rest encryption, it is 
  difficult or impossible to choose the best approach to implement encryption and verify 
  whether the implementation meets the set of goals. 
  
  The following items are worth considering during the design of a solution that includes 
  data-at-rest encryption: 
  
  (cid:2) Legal requirements 
  (cid:2) Contractual obligations 
  (cid:2) Organization's security policy 
  (cid:2) Attack vectors 
  (cid:2) Expected resources of an attacker 
  (cid:2) Encryption key management 
  (cid:2) Physical security 