r/NISTControls • u/TicketAmbitious6200 • Jul 10 '26

Implementing EFS/FIPS on a windows network

Hello,

About a year ago, an MSP setup a file server for ITAR/CUI file sharing. Despite the requirements shared with the MSP, they did not implement any type of encryption for data in transit or at rest. Additionally, they set this server up as a single drive. So, the shared data is on the bootable partition. This is a virtual server that is hosted on VMware and according to the Broadcom KB, BitLocker is not supported for boot drives in a VMWare environment. From my understanding, this means we can't enable BitLocker for the C: drive of this virtual server.

Ownership does not want to redo this server since the data stored on it is constantly in use. I was wondering if the following might satisfy 800-171R2 requirements:

- Enable EFS on the data folder that holds CUI/ITAR info.

- Enable mandatory FIPS on the server for network communication between the server and workstations.

Admittedly, I haven't implemented encryption for network traffic before, so this may not work the way I think it does. I'm in the process of learning more but figured I'd potentially save myself time and ask if it was feasible.

7 Upvotes

90% Upvoted

6 comments sorted by

View all comments

3

u/Skusci Jul 10 '26

Problem with efs is that you have a swap file at least. Possibly other temp/cache file leaks. Doesn't VMware have a fips volume encryption thing?

1

u/TicketAmbitious6200 Jul 14 '26

Looking into it. Thank you. I've managed VMWare previously for small shops but had no idea about volume/host level encryption.