NetApp Aggregate Encryption (NAE) is a software-based data-at-rest encryption solution integrated into NetApp's ONTAP data management platform that employs AES-256-bit XTS encryption at the RAID layer to secure data while preserving storage efficiencies like inline compression, deduplication, and thin provisioning. Unlike volume-level encryption, NAE assigns unique encryption keys per storage aggregate, enabling all volumes within an encrypted aggregate to share cryptographic keys, allowing cryptographic erasure of entire aggregates when deleted. NAE operates independently of hardware, supporting any drive type without requiring self-encrypting drives, though it can layer with hardware encryption for dual protection. The solution uses FIPS 140-2 Level 1-validated cryptographic modules and integrates with both onboard and external KMIP-compliant key managers. By default in ONTAP 9.7+, new aggregates automatically enable NAE when a Volume Encryption license and configured key manager exist, and all volumes in NAE aggregates must be encrypted, prohibiting unencrypted data storage.
