Data Protection - Volume Encryption Coverage

Description

The percentage of systems with their volumes fully encrypted, ensuring that sensitive data is protected from unauthorized access in the event of a device loss or breach, which is crucial for safeguarding company assets and complying with data protection regulations.

How we measure it

Macs managed by Kandji that checked in within the last 30 days are considered compliant if FileVault is enabled. Active Windows devices registered in Okta are considered compliant if Okta reports all internal volumes, or the full disk, as encrypted.

Meta Data

Attribute	Value
Metric id	dp_volume_encrypted
Category	Data Protection
SLO	90.00% - 95.00%
Weight	0.5
Type

References

Framework	Ref	Domain	Control
CIS 8.1	3.11	Data Protection	Encrypt Sensitive Data at Rest
ISO 27001:2022	A.8.24	8 Technological controls	Use of cryptography
NIST CSF v2.0	PR.DS-01	Data Security (PR.DS)	PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected

Code

SELECT
  details.device_name || ' (' || details.serial_number || ')' AS resource,
  'host' AS resource_type,
  CASE WHEN details.filevault_enabled IS TRUE THEN 1 ELSE 0 END AS compliance,
  CASE WHEN details.filevault_enabled IS TRUE THEN 'FileVault enabled' ELSE 'FileVault not enabled' END AS detail
FROM {{ ref('kandji_device_details') }} AS details
JOIN {{ ref('kandji_devices') }} AS devices ON devices.device_id = details.device_id
WHERE details.platform = 'Mac'
  AND NOT devices.is_missing AND NOT devices.is_removed
  AND CURRENT_DATE - CAST(devices.last_check_in AS DATE) <= 30

SELECT
  profile_displayname AS resource,
  'host' AS resource_type,
  CASE WHEN profile_diskencryptiontype IN ('ALL_INTERNAL_VOLUMES', 'FULL') THEN 1 ELSE 0 END AS compliance,
  'Disk encryption: ' || coalesce(profile_diskencryptiontype, 'not reported') AS detail
FROM {{ ref('okta_devices') }}
WHERE profile_platform = 'WINDOWS'
  AND status = 'ACTIVE'