A regulator asks whether customer data is encrypted. The team says yes, disks are encrypted. Is that a sufficient answer?

What disk encryption actually protects against

Someone obtaining the physical medium or a raw storage snapshot. In a cloud context that means a provider employee with data-centre access, or a decommissioned drive.

It does not protect against: a compromised application, a stolen credential, an over-permissive IAM role, SQL injection, a database administrator, or a misconfigured backup made public. The storage layer decrypts transparently for any authorised caller — which is every realistic attacker who has got as far as reading your data.

Nearly every well-known cloud data breach involved data that was encrypted at rest, and the encryption was irrelevant to the outcome.

So the honest answer to the regulator

Disk encryption is enabled, it satisfies the baseline control, and it is not the control that protects customer data from the threats that actually occur. The remaining protection comes from access control, and the answer should describe that.

What a complete answer covers

In transit — TLS everywhere including internal service-to-service, which defends against the realistic network attacker.

Access control — who and what can read the data, enforced by least privilege, with the authorisation model auditable and access reviewed.

Field-level encryption or tokenisation for the highest-sensitivity fields, so a database compromise yields ciphertext or meaningless tokens. This is the control that survives credential theft, and it costs you the ability to index and query those fields — a design constraint, not a setting.

Key management — where keys live, who can use them, rotation, and separation of duty between key custodian and data custodian. Encryption whose keys are available to the same identity as the data provides limited protection.

Detection — would you know if the data were read en masse?

What a strong answer adds

Reframing the regulator's question as the one worth answering internally: "if an attacker obtained our application's credentials, what data could they read?" That is the threat model that matters, and it usually leads to tokenisation and access control rather than to more encryption — with the additional benefit that tokenisation removes data from compliance scope entirely rather than protecting it within scope.