Protect · Foundational tier · Data Protection

PR-05Data at rest is encrypted

Endpoints and stored account data are encrypted, and card numbers are unreadable wherever stored.

Status

Evidence indicates

All 2 items support it and are fresh.

Exposure

High

2 evidence items from 2 sources

CCSA · Protect

Below Foundational

Not blocking this domain's next tier.

Evidence chain

Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.

ev-pr05-1

Full-disk encryption on 99.4% of managed endpoints

Microsoft Defender and Intune · telemetry · collected 1 h ago (Oct 15, 2026 · 12:59 UTC) · limit 30 days

Supports

Query: GET /deviceManagement/managedDevices?$select=id,isEncrypted,complianceState (IMEI, phone and email fields dropped)
Identity: app assurance-ro (DeviceManagementManagedDevices.Read.All)
Collector: defender-collector 1.8.0
Window: 24 h
Records: 11,702
SHA-256: 1eb922bb45a702421549b3d8f8a117e323bd31b1c46b74f74daca3061e18a850

ev-pr05-2

Discovery scan found no clear-text card numbers in scope

Tenable Vulnerability Management · export · collected 14 h ago (Oct 14, 2026 · 23:59 UTC) · limit 30 days

Supports