Why this matters
Defense-in-depth encryption supports SOC 2 confidentiality.
Use AES-GCM with keys from KMS to encrypt sensitive columns (e.g., SSN) before saving; store nonce and auth tag; never rely solely on disk encryption.
Defense-in-depth encryption supports SOC 2 confidentiality.
Side-by-side examples engineers can pattern-match during review.
user.setSsn("123-45-6789"); repo.save(user);user.setSsnCipher(crypto.encrypt(ssn)); repo.save(user);crypto.encrypt(ssn)repo.save(ssn)From the same buckets as this rule.
Public services must require TLSv1.2 or higher and set HSTS (max-age ≥ 15552000, includeSubDomains). Reject plaintext HTTP and weak ciphers; cookies must be Secure and HttpOnly with SameSite set.