[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-111":3},{"item":4,"lessons":16,"controls":50,"related":79},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-111","SP 800-111","SP 800-111: Guide to Storage Encryption Technologies for End User Devices",8,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidance on storage encryption for end user devices such as laptops and removable media. It explains full disk encryption, virtual disk and volume encryption and file and folder encryption, and how to plan, implement and manage them.\n\n**In practice.** Applying it well means choosing encryption suited to the device and threat, usually full disk encryption for laptops, enforcing it centrally and managing recovery keys securely. Removable media is encrypted or blocked. Evidence includes encryption policy, compliance reports from device management and procedures for key recovery.\n\n**Common gaps.** Common gaps are devices that were never encrypted, recovery keys stored insecurely and removable media left uncontrolled. The publication dates from 2007, so product details are outdated, but the principles hold.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46],{"slug":19,"title":20,"published_at":21},"fbi-cjis-v61-raises-the-bar-on-encryption-and-vulnerability-scanning","FBI CJIS v6.1 Raises the Bar on Encryption and Vulnerability Scanning","2026-09-21T16:21:54.052+00:00",{"slug":23,"title":24,"published_at":25},"stolen-unencrypted-laptop-triggers-gdpr-fines-for-controller-and-processor","Stolen Unencrypted Laptop Triggers GDPR Fines for Controller and Processor","2026-07-30T14:20:23.867+00:00",{"slug":27,"title":28,"published_at":29},"confidential-computing-protecting-data-in-use-with-tees-on-cpus-and-gpus","Confidential Computing: Protecting Data in Use with TEEs on CPUs and GPUs","2026-07-28T12:20:34.412+00:00",{"slug":31,"title":32,"published_at":33},"greatxml-exploit-bypasses-bitlocker-through-recovery-partition-manipulation","GreatXML Exploit Bypasses BitLocker Through Recovery Partition Manipulation","2026-06-11T20:21:28.128+00:00",{"slug":35,"title":36,"published_at":37},"bitlocker-bypass-vulnerability-exposes-encrypted-data-risk","BitLocker Bypass Vulnerability Exposes Encrypted Data Risk","2026-06-11T15:20:16.67+00:00",{"slug":39,"title":40,"published_at":41},"bitlocker-recovery-bug-demonstrates-patch-testing-risks","BitLocker Recovery Bug Demonstrates Patch Testing Risks","2026-06-11T10:20:52.356+00:00",{"slug":43,"title":44,"published_at":45},"bitlocker-zero-day-exposes-critical-need-for-defense-in-depth-encryption","BitLocker Zero-Day Exposes Critical Need for Defense-in-Depth Encryption","2026-05-22T05:41:48.513478+00:00",{"slug":47,"title":48,"published_at":49},"bitlocker-bypass-vulnerability-exposes-encrypted-data","BitLocker Bypass Vulnerability Exposes Encrypted Data","2026-05-22T05:40:49.61017+00:00",[51,56,61,66,71,75],{"slug":52,"name":53,"problem":54,"stories":55},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",7,{"slug":57,"name":58,"problem":59,"stories":60},"patch-management","Automated patch management","Known holes get closed in days, not months.",6,{"slug":62,"name":63,"problem":64,"stories":65},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",4,{"slug":67,"name":68,"problem":69,"stories":70},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",1,{"slug":72,"name":73,"problem":74,"stories":70},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":76,"name":77,"problem":78,"stories":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[80,85,90,96,100,105,109,113],{"family":81,"item":82,"code":83,"title":84,"together":60},"cis","3","Control 3","Data Protection",{"family":86,"item":87,"code":88,"title":89,"together":65},"nist-800-53","sc-28","SC-28","Protection of Information at Rest",{"family":91,"item":92,"code":93,"title":94,"together":95},"gdpr","32","Article 32","Security of processing",3,{"family":81,"item":97,"code":98,"title":99,"together":95},"7","Control 7","Continuous Vulnerability Management",{"family":81,"item":101,"code":102,"title":103,"together":104},"8","Control 8","Audit Log Management",2,{"family":91,"item":106,"code":107,"title":108,"together":104},"25","Article 25","Data protection by design and by default",{"family":81,"item":110,"code":111,"title":112,"together":104},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":91,"item":114,"code":115,"title":116,"together":70},"24","Article 24","Responsibility of the controller"]