In RMF, where does encryption at rest typically fall within controls?

• A. System and Information Assurance
• B. System and Communications Protection
• C. Access Control
• D. Media Protection

Answer: (B)

Encryption at rest is a cryptographic safeguard applied to data stored on media to keep it confidential even if the storage device is exposed. In RMF, this kind of protection is addressed by System and Communications Protection because it concerns protecting information within the system boundary through cryptography, encompassing protections for data both at rest and during transmission and the related key management. This makes it the most fitting home for encryption practices, since the goal is to prevent unauthorized disclosure or tampering of information as it resides in the system, not just who can access resources or how media is managed. The other families focus more on who is allowed to access resources (Access Control), the handling and sanitization of media itself (Media Protection), or broader system integrity and assurance concepts, rather than the cryptographic protection of information in storage and across interfaces.