Mapping Ceph encryption, replication, immutability and audit features to the storage, backup and cryptography requirements auditors test.
How Ceph encryption at rest and in transit, replication and immutable copies support the HIPAA Security Rule's addressable encryption and required contingency plan specifications, and the documentation a risk analysis needs.
Where personal data lingers in a Ceph cluster: object versions, Object Lock retention, RBD and CephFS snapshots, mirrored and multisite copies, and documenting erasure and its exceptions.
Meeting DORA backup rules with Ceph: segregated recovery targets, replication versus backup, immutable copies, restore testing, and setting RTO and RPO per function.
Mapping Implementing Regulation 2024/2690 point 4.2 to Ceph: off-network backup copies, integrity checks, recovery tests, redundancy across sites and the evidence ENISA lists.
Evidence a Ceph platform can give for A.8.13 Information backup and A.8.24 Use of cryptography: replication and backup targets, restore tests, encryption at rest and in transit, and key management with an external KMS.
Why encrypted OSDs alone do not satisfy PCI DSS for stored PAN, application-level or RGW server-side encryption with managed keys, and scoping backups and logs that hold card data.
Using Ceph encryption at rest and msgr2 secure mode for 03.13.08 transmission and storage confidentiality, FIPS questions to settle, and the CMMC Level 2 scoring impact.
Using RGW Object Lock and separate backup administrator accounts so backups cannot be changed or deleted during retention, as Essential Eight maturity levels require, and testing restores.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.