Encryption at rest
Cryptographic protection for stored data on disks, databases, backups, or object storage.
In practice
Enable managed encryption, restrict key administration, rotate keys where justified, and test backup restoration.
Common confusion
Storage encryption does not protect data after an authorized application decrypts it.