Data At Rest

Each [a]–[z] objective is scored independently; one NOT MET fails the requirement. Expand any objective to see the evidence behind it — every item carries a SHA-256 and the time it was collected. Substantiation is reported separately and never changes the finding.

• a

  the confidentiality of CUI at rest is protected.

  METUnsubstantiated

  • Not yet evidenced — 2 validator check(s) never observed: az.storage.encryption.cmk_enforced, azure.disk.encryption
  • Not yet evidenced — 2 validator check(s) never observed: os.bitlocker.all_volumes_protected, os.bitlocker.system_drive_protected
  • Not yet evidenced — 1 of 1 bundle artifact(s) not present in any collected run
  • Not yet evidenced — no finalized control_monitoring entries on file
  • Not yet evidenced — 1 of 1 governance document(s) not on file: MAC-POL-225

Requirement → objective → evidence → asset → owner → validation → framework, as rows. 1 of 1 objectives scored, 0 evidence citations · snapshot 9/19/2026 (rows).

Owner

Unassigned

Validation

Weekly canonical hardening run · Quarterly · last 9/15/2026

Finding

MET

Also supports

A.8.24

1. 3.13.16[a]MET (inherited)responsibility: provider (inherited_from_control, template)

   the confidentiality of CUI at rest is protected.