# SEC08-BP02: Enforce encryption at rest

## Description

Encrypt all storage.

## Implementation Guidance

- Default encryption enabled
- Customer-managed keys where needed
- Database encryption
- Backup encryption
- Encryption validation

## Risk Level

High - Unencrypted data is exposed if accessed.
