ER-47 Walkthrough - Data Encryption at Rest And in Transit Configurations

What to Provide

(1) The documented policy/procedure that defines your organization's process for enabling encryption over public networks and encrypting data at rest.

(2) A screenshot demonstrating that your organization's production data stores are encrypted at rest.

(3) A screenshot demonstrating all public-facing web addresses and public-facing APIs that are used to provide your in-scope services.

(4) Evidence demonstrating the Transport Layer Security (TLS) configuration settings for the in-scope production network and production API traffic. This evidence should demonstrate that your sensitive data is encrypted in transit.

Evidence Format
Exported word processing documents in a common file type such as .docx or .pdf., screenshots, or exported images in a common image file type such as .jpg, .png, or .pdf.

Additional Guidance

(1) The evidence should demonstrate:

(2) If the service you are using encrypts data by default at rest, please provide the supporting documentation.

(3) The production URLs that were included in-scope for the penetration test can also be utilized to satisfy this request.

(4) We recommend that you use transport socket layer (TLS) 1.2 or higher encryption for data in transit over public and untrusted networks.

If you do not use TLS 1.2 or higher, explain why in the Evidence Description.

Example Evidence (Data Encryption at Rest)

Example Evidence

AWS RDS

AWS S3

AWS DynamoDB

Azure SQL