NetApp Volume Encryption (NVE) provides software-based data-at-rest encryption integrated into ONTAP storage systems. It employs AES-256 bit encryption at the volume level, enabling granular protection of individual datasets while maintaining storage efficiencies like deduplication and compression. NVE operates independently of physical media types and supports both self-encrypting drives for layered security and non-SED drives for basic encryption. It uses per-volume encryption keys with XTS-AES-256 mode and integrates with NetApp's Onboard Key Manager or external KMIP-compliant key servers. The solution preserves storage efficiency features during encryption processes, supports SnapLock compliance volumes and FlexClone replicas, and enables secure cryptographic erasure through key deletion. NVE encrypts both data and metadata, including snapshots, while maintaining full RAID protection and can be deployed alongside hardware-based encryption for dual-layer security compliance requirements.
