Encryption-at-rest gap on general ledger replica

CTRL-DP-112/APRA CPS 234 Information Security, ISO 27001 Annex A.8.24, and internal data classification standard FIN-DATA-03.

Control statement

Databases storing confidential or restricted financial data, including replicas and non-production copies, must enforce encryption at rest using enterprise-managed keys before any restore, snapshot mount, or analytics attachment is approved.

What the evidence shows

The configuration snapshot for the restored replica records storage_encrypted=false and no KMS key association. The corresponding Terraform plan created new storage attachments in the analytics VPC without inheriting the production encryption module, and the CMDB asset record still classifies the replica as holding restricted finance data.

Evidence artefacts

rds-config-snapshot-2026-04-02.json
terraform-plan-gl-replica.txt
cmdb-asset-register-gl-analytics.csv

Affected assets

1 database replica and 4 attached storage volumes

PressRto run·1–5for stages

Remediation Memory

2 similar past remediations found

94%Similarity
CTRL-DP-089·closed on 22 Jan 2026
Encryption-at-rest remediation on archive databases
Enabled storage-level encryption with enterprise-managed KMS keys across the archive database cluster, rebuilt affected storage volumes, and added a Terraform module guardrail preventing unencrypted restores.
- Same control domain: Data Protection
- Same severity: High
- Control ID family: CTRL-DP-
- Keyword overlap: encryption, rest, replica, storage, kms, terraform, volume
45 min · closed by Evelyn4 reusable artefacts
55%Similarity
CTRL-DP-124·closed on 08 Mar 2026
Log retention policy extension across audit streams
Extended the observability index lifecycle from 30 days to 12 months for regulated audit streams, introduced a warm archive tier, and added retention policy linting to the platform pipeline.
- Same control domain: Data Protection
- Same severity: High
- Control ID family: CTRL-DP-
31 min · closed by James4 reusable artefacts

Agent workspace

Click "Run remediation agent" to begin. The agent will diagnose the gap, plan the remediation, and ship the work in real time.