← GLBA · Safeguards Rule (16 CFR 314)

314.4(c)(3) — Encryption of customer information in transit and at rest

critical encryption-at-restencryption-in-transit

Requirement

All customer information held or transmitted is encrypted, both in transit over external networks and at rest. Where encryption is infeasible, the Qualified Individual may approve effective alternative compensating controls, which must be reviewed.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

encryptencryptionencrypted

Required element 2 — any one of

in transitat reststoredtransmittedtransmission

Supporting terms — specificity signals

314.4(c)(3)aes-256tlscompensating controlqualified individual

Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

customer information is not encrypted is stored unencrypted stored unencrypted unencrypted at rest no encryption is not encrypted at rest are not encrypted

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
GDPR	Art.5(1)(f)	Integrity and confidentiality	encryption-at-rest encryption-in-transit
SOC 2	CC6.7	Restriction of information transmission, movement and removal	encryption-in-transit encryption-at-rest
ISO 27001	A.8.24	Use of cryptography	encryption-at-rest encryption-in-transit
GDPR	Art.32	Security of processing	encryption-at-rest encryption-in-transit
CCPA/CPRA	1798.100(e) & 1798.150	Reasonable security procedures	encryption-at-rest
SOC 2	CC6.6	Boundary protection	encryption-in-transit
ISO 27001	A.5.14	Information transfer	encryption-in-transit
ISO 27001	A.7.10	Storage media	encryption-at-rest