OpenControls Logo

STIG Viewer

STIGViewer Support

The vCenter Server must enable data at rest encryption for vSAN.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-258929VCSA-80-000196SV-258929r961599_ruleCCI-002475medium
Description
Applications handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. Data encryption is a common technique used in environments that require additional levels of security. It consists of a process to ensure that data can only be consumed by systems that have appropriate levels of access. Approved systems must have and use the appropriate cryptographic keys to encrypt and decrypt the data. Systems that do not have the keys will not be able to consume the data in any meaningful way, as it will remain encrypted in accordance with the commonly used Advanced Encryption Standard (AES) from the National Institute of Standards and Technology, or NIST. vSAN supports Data-At-Rest Encryption and Data-in-Transit Encryption and uses an AES 256 cipher. Data is encrypted after all other processing, such as deduplication, is performed. Data at rest encryption protects data on storage devices in case a device is removed from the cluster.
STIGDate
VMware vSphere 8.0 vCenter Security Technical Implementation Guide2026-05-23

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

BCD-11.4Cryptographic Protection
0.50
CRY-04Transmission Integrity
0.50
CRY-05Encrypting Data At Rest
0.50
DCH-07.2Encrypting Data In Storage Media
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
CM-5(3)Signed Components
1.00
CM-6Configuration Settings
1.00
CM-7(5)Authorized Software — Allow-by-exception
1.00
IA-5(1)Password-based Authentication
1.00
IA-7Cryptographic Module Authentication
1.00
SC-13Cryptographic Protection
1.00
SC-23(3)Unique System-generated Session Identifiers
1.00
SC-28Protection of Information at Rest
1.00
SC-28(1)Cryptographic Protection
1.00

+3 more (top 10 by confidence shown)

CCI1 mapping
CCI-002475
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-01
0.50
PR.DS-02
0.50

Details

Check Text (C-258929r961599_chk)

If no clusters are enabled for vSAN, this is not applicable. From the vSphere Client, go to Host and Clusters. Select the vCenter Server >> Select the cluster >> Configure >> vSAN >> Services >> Data Services. Review the "Data-at-rest encryption" status. or From a PowerCLI command prompt while connected to the vCenter server, run the following command: Get-Cluster | Where-Object {$_.VsanEnabled -eq $true} | Get-VsanClusterConfiguration | Select-Object Name,EncryptionEnabled If "Data-At-Rest encryption" is not enabled, this is a finding.

Fix Text (F-62578r934444_fix)

From the vSphere Client, go to Host and Clusters. Select the vCenter Server >> Select the target cluster >> Configure >> vSAN >> Services >> Data Services. Click "Edit". Enable "Data-At-Rest encryption" and select a pre-configured key provider from the drop down. Click "Apply". Note: Before enabling, read and understand the operational implications of enabling data at rest encryption in vSAN and how it effects capacity, performance, and recovery scenarios.