Data at Rest
Data-at-rest is data stored in any persistent form — databases, file systems, cloud storage, backups, and endpoints. Learn the security controls that protect it, how encryption works, and where most organisations have gaps.
What is Data-at-Rest?
Data-at-rest is data stored in any persistent form and not actively moving across a network. Databases, file systems, cloud object storage buckets, SaaS platform content stores, backup archives, and files on employee laptops: all of it is data-at-rest. It's the state in which most sensitive data spends most of its time.
Data has three states: at rest, in motion, and in use. Each state carries distinct risks and requires distinct controls. Data-at-rest is the stored state. Protecting it is one of the most consistently required obligations across GDPR, HIPAA, PCI DSS, and virtually every other regulatory framework that addresses data security.
Where data-at-rest exists
Data-at-rest exists anywhere data is stored persistently. That covers more locations than most data inventories reflect.
Databases: Production databases are the obvious category: the customer database, the financial records system, the healthcare records platform. But data-at-rest also exists in development databases seeded from production copies, analytics databases populated by ETL pipelines, and database snapshots created during backup cycles.
File systems and object storage: Files on on-premises file servers, documents in SharePoint, spreadsheets in Google Drive, files in S3 buckets, content in Azure Blob storage. Each file is data-at-rest. Each storage container is a scope boundary for access controls and encryption policies.
SaaS platform content stores: Customer records in Salesforce, messages in Slack, tickets in Jira, email in Microsoft 365: all of this is data-at-rest, stored by the SaaS provider on the organisation's behalf. The organisation's access controls and encryption choices are constrained by what the SaaS platform supports and exposes.
Backup archives: Backup copies are data-at-rest that often receives less security attention than primary systems. The daily backup snapshot of a production database contains the same sensitive data as the production database, but may sit in a storage tier with different encryption defaults, different access controls, and no monitoring.
Endpoints: Files on employee laptops and desktops are data-at-rest. Downloaded spreadsheets, cached documents, locally saved copies of SaaS content: all of it persists on the device in storage. Endpoints are where data-at-rest is most commonly unencrypted and least consistently monitored.
How data-at-rest is protected
Three controls work together to protect data-at-rest. Each addresses a different attack vector.
Encryption: Encryption converts data into ciphertext using a cryptographic key. Without the key, the ciphertext is unreadable. Physical theft of a storage device, logical access to a storage volume, or exfiltration of raw database files all become non-events if the data is encrypted at rest and the key is appropriately protected. AES-256 is the current standard for symmetric encryption at rest. For regulated environments, HIPAA's Breach Notification Safe Harbor specifically removes the notification obligation for breached data that was encrypted to NIST standards, providing direct regulatory incentive for encryption.
Access controls: Encryption protects against attackers who gain access to the storage medium without decryption keys. Access controls protect against attackers who gain access to the data through legitimate application interfaces. Least-privilege access policies, role-based access control, and regular access reviews limit who can query or retrieve sensitive data-at-rest through normal database and file system interfaces.
Discovery and classification: Encryption and access controls only protect data-at-rest that the security programme knows exists. The unencrypted development database, the forgotten backup archive, the employee's locally stored copy of a customer spreadsheet: none of these receive the protection that primary systems have, because they're not in the data inventory. Discovering where data-at-rest actually exists across all environments is the prerequisite for applying controls to all of it.
Data-at-rest vs data-in-motion vs data-in-use
Dimension | Data-at-Rest | Data-in-Motion | Data-in-Use |
|---|---|---|---|
State | Stored persistently | Transmitting across a network | Being processed in memory |
Primary risk | Unauthorised access to storage | Interception during transmission | Memory scraping, session hijacking |
Primary control | Encryption at rest, access controls | TLS/HTTPS encryption in transit | Memory protection, access controls |
Example | A database row | A file upload | An open spreadsheet in memory |
Regulatory focus | HIPAA Safe Harbor, PCI DSS Req. 3 | PCI DSS Req. 4, GDPR Article 32 | Varies by framework |
These three states are not mutually exclusive across an organisation's data estate. The same piece of sensitive data moves through all three states in normal operation: it's at-rest in a database, moves in-motion when an application queries and transmits it, becomes in-use when a process reads it into memory, and returns to at-rest when written back to storage.
The encryption gap: where data-at-rest is actually unencrypted
Most organisations believe their data-at-rest is encrypted because their primary databases and cloud storage buckets have encryption enabled. That's the easy part. The harder problem is the copies.
A production database that's encrypted at rest generates a daily backup that lands in a cold storage tier with default encryption settings — which in some configurations means no encryption. A developer exports a subset of production data to test a new feature, saving it to a local directory that isn't covered by the organisation's disk encryption policy. A legacy system migrated years ago has data-at-rest in a volume that was never updated to use current encryption standards because the migration checklist didn't catch it.
None of those gaps are visible to an organisation that only monitors its primary systems. They're only visible when data discovery covers the full environment: cloud storage tiers including cold and archive tiers, development and test environments, endpoint devices, and legacy systems that predate current encryption standards.
The real encryption gap isn't usually in the primary systems. It's in everything else.