The IBM z/VM systems requiring data at rest must employ IBMs DS8000 for full disk encryption.
Overview
Finding ID
Version
Rule ID
IA Controls
Severity
V-237973
IBMZ-VM-002430
SV-237973r649759_rule
Medium
Description
Operating systems handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields).