text: Multiple regulations mandate data-at-rest encryption, from processing of Sensitive Personal 
  Information to the guidelines of the Payment Card Industry. If any regulatory or contractual 
  obligations govern the data that is held on the storage system, they often provide a wide and 
  detailed range of requirements and characteristics that need to be realized by that system. 
  Apart from mandating data-at-rest encryption, these documents might contain requirements 
  concerning encryption key management. 
  
  Another document that should be consulted when planning data-at-rest encryption is the 
  organization’s security policy. 
  
  The outcome of a data-at-rest encryption planning session answers the following questions: 
  
  1. What are the goals that the organization wants to realize by using data-at-rest encryption? 
  2. How will data-at-rest encryption be implemented? 
  3. How can it be demonstrated that the proposed solution realizes the set of goals? 