Encryption at rest and key custody talking points
Overview
Encrypting backups protects data if drives stolen—but key loss equals data loss. Custody clarity is contractual.
Explain
Who holds master keys, rotation cadence, escrow for bankruptcy scenarios (legal review).
Cloud
Customer-managed keys (CMK) add ops burden—price support accordingly.
Audit phrase
“We support encryption at rest using vendor algorithm X; you retain passphrase Y in enterprise vault Z.”
DR test
Include restore with escrowed key drill annually.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...