As Air Force missions become more distributed, autonomous, and data-intensive, sensitive information is increasingly stored on systems operating beyond traditional physical-security boundaries. Aircraft, unmanned systems, mission computers, tactical servers, maintenance equipment, and edge-compute platforms may all retain valuable data long after power is removed.
This creates a fundamental data at rest (DAR) challenge. Air Force systems operating at the tactical edge may be lost, damaged, or captured, placing the physical device and its storage directly in an adversary’s possession. Protecting the network is no longer enough. The information stored on the system itself must remain protected even when the system is disconnected from friendly networks and outside U.S. control.
A lost device doesn’t need to contain thousands of classified documents to create a significant intelligence loss.
Depending on its mission, it may retain:
Collectively, this information can reveal where forces have operated, what they can detect, how they communicate, how platforms respond to threats, and potentially how future missions will be conducted.
The Air Force has always operated sensitive computing systems outside traditional data centers. What’s changing is the quantity, sensitivity, and operational value of information moving to the edge. Distributed Operations Agile Combat Employment and other distributed operating concepts place personnel, aircraft, computing, maintenance capabilities, and mission systems across dispersed locations. Distribution improves resilience, but it also creates more locations and endpoints where sensitive information must be protected.
Modern operations increasingly require processing to occur close to aircraft, sensors, operators, and weapons. That reduces latency and dependence on distant infrastructure, but it also moves data from centralized facilities onto tactical servers, mission systems, laptops, and other physically vulnerable devices. Artificial intelligence further increases the value of edge systems. An AI-enabled endpoint may retain trained models, algorithms, sensor data, and operational datasets. Losing the hardware can therefore potentially expose not only mission information but also the technology used to interpret that information. The Air Force is rapidly expanding its use of remotely piloted, unmanned, collaborative, and autonomous aircraft. The security issue isn’t limited to highly autonomous systems. An MQ-9, smaller UAS, or future Collaborative Combat Aircraft can retain valuable information regardless of how much human control is involved. Autonomy may increase the value of the information. Physical vulnerability creates the underlying DAR risk.
Most cybersecurity discussions focus on preventing attackers from remotely penetrating networks and computers. Tactical and expeditionary operations create another problem: The adversary may physically possess the computer, or the entire aircraft.
Imagine an aircraft, UAS, mission computer, or expeditionary system recovered by a nation-state adversary. The adversary may now possess its storage, processors, firmware, operating environment, and other components. They can remove SSDs, disassemble equipment, connect components to specialized forensic tools, acquire identical hardware for experimentation, and may have teams of intelligence analysts, hardware engineers, firmware specialists, reverse engineers, and cryptographers with months to exploit it.
The question is no longer: “Can they penetrate our network?” It becomes: “With our equipment sitting on their laboratory bench, can they recover what’s stored inside it?” That is a DAR problem.
Commercial encryption can provide excellent protection for enterprise information. Classified National Security Systems face a different threat model. A common misconception is that a system is adequately protected because it uses AES-256, commercial full-disk encryption, or a “FIPS-certified” drive. Those can be valuable security attributes. They don’t, by themselves, constitute a classified DAR architecture. A sophisticated adversary doesn’t necessarily need to mathematically defeat AES. They can search for easier paths: Where are the encryption keys stored? What causes the storage to unlock? Does it automatically unlock during startup? How is the operator authenticated? Can authentication be bypassed? Can firmware or the boot environment be manipulated? Does compromising one component expose all of the stored information? The better question isn’t: “How strong is the encryption?” It is: “What must an adversary defeat before the classified data becomes accessible?”
FIPS cryptographic validation provides important assurance that specified cryptographic functionality has been tested against defined requirements. But a device containing FIPS-validated cryptography isn’t automatically a complete solution for protecting classified DAR. Consider an aircraft hangar protecting a highly sensitive platform. Having an approved lock on one door is valuable. But the strength of that lock doesn’t determine the security of the entire facility. Security also depends on the walls, other entrances, credentials, alarms, procedures, and how those protections work together. DAR is similar. Cryptography is a critical component of security. It isn’t the entire security architecture. For classified National Security Systems, NSA provides important direction on how that architecture should be constructed.
National Security Presidential Memorandum 12 (NSPM-12), National Policy for the Cybersecurity of National Security Systems, issued in June 2026, establishes cybersecurity governance for NSS and reinforces accountability for protecting systems supporting military, intelligence, and other national-security missions. Importantly, NSPM-12 reestablishes the Director of the National Security Agency as the National Manager for National Security Systems, including responsibilities associated with minimum requirements for cryptology and cryptographic systems. For Air Force organizations developing, acquiring, and operating NSS, that distinction matters. Protecting classified information isn’t simply a matter of selecting a commercially available cybersecurity product or encrypted SSD. NSA has a defined national role in establishing how cryptographic protections for NSS are implemented. One important mechanism for doing so is the Commercial Solutions for Classified program.
NSA’s Commercial Solutions for Classified (CSfC) program enables appropriately evaluated commercial technologies to be used within NSA-defined architectures to protect classified information. For stored information, NSA’s Data-at-Rest Capability Package defines architectures for DAR protection.
CSfC changes the question from: “Is this device encrypted?” to: “Does the complete solution provide the layers of protection required for classified information?” Several concepts are particularly relevant to Air Force systems.
Layered Protection
CSfC DAR employs defense in depth instead of relying entirely on one encryption mechanism. If an adversary compromises one independent layer, another protection layer is intended to remain between the attacker and the classified information.
Evaluated Components
CSfC architectures use commercial products evaluated for specific security functions and selected according to applicable NSA requirements. A vendor’s statement that a product uses “military-grade encryption” isn’t equivalent to being evaluated for a defined role in a classified DAR architecture.
Encryption Plus Authentication
Strong encryption is useful only if unauthorized users cannot easily cause storage to unlock. Think of hardware-encrypted storage as a high-security aircraft shelter.
Encryption provides the reinforced structure. Authentication controls the door. A tremendously strong shelter provides limited protection if the door automatically opens for anyone who powers up the control system. Both protections matter.
Protection of Cryptographic Keys
Encryption keys are critical assets. A sophisticated adversary may have little reason to attack AES directly if they can instead recover or exploit the mechanism protecting its keys.
DAR architecture therefore considers key generation, protection, storage, and authorization, not simply the algorithm used to encrypt the data. This may be the most important consideration for distributed Air Force operations. A captured aircraft, UAS, expeditionary server, or mission computer may be completely disconnected from friendly networks. Remote wipe may not work. Enterprise security services may be unreachable. The protection therefore must remain effective on the endpoint itself. Physical possession of the system should not equal possession of its classified information.
The Air Force has spent decades engineering survivability into platforms and operations. Stealth reduces detection. Electronic warfare complicates targeting. Countermeasures protect aircraft. Distributed operations reduce dependence on individual bases. Redundancy helps missions continue despite losses. As computing and data become increasingly integral to combat capability, information survivability deserves the same attention.
Programs developing and acquiring NSS should ask:
And for classified information: Does the system implement the appropriate NSA-approved DAR architecture for the information it carries? These should be design and acquisition questions, not questions first asked after a platform has been fielded.
The Air Force is becoming more distributed, connected, autonomous, AI-enabled, and data-intensive. That means more valuable information is being stored on aircraft, unmanned systems, tactical servers, mission computers, maintenance systems, and expeditionary endpoints operating beyond traditional physical-security boundaries. The operational reality is straightforward: If we cannot guarantee possession of the device, we must ensure that possession of the device does not provide possession of its data. Commercial encryption and FIPS-validated cryptography can be important components.
For classified information, however, simply checking an encryption box isn’t enough. NSPM-12 reinforces NSA’s central role in protecting National Security Systems, while NSA’s CSfC DAR program provides architectures for combining evaluated commercial technologies into layered protections for classified information.
For the Air Force, DAR should therefore be viewed as more than an IT or cybersecurity requirement. It is information survivability, and increasingly, mission survivability. The Air Force may not always be able to prevent an aircraft, UAS, mission computer, or expeditionary endpoint from being lost, damaged, or captured. It can, and should, design systems so the classified information stored inside doesn’t become an adversary’s intelligence advantage.
Conner Crisafulli is a solutions engineer and cybersecurity professional at Cigent with a unique background bridging elite military operations and advanced data security. Before joining Cigent, Conner served six years as a U.S. Air Force Combat Controller, where he specialized in high-stakes mission planning, communication systems, and joint operations coordination/execution. Drawing from his experience in complex, contested environments, Conner now helps federal agencies and enterprise clients strengthen their data-at-rest protection strategies. At Cigent, he focuses on practical applications of self-encrypting drives (SEDs), pre-boot authentication (PBA), and various CSfC (commercial solutions for classified) technologies to safeguard sensitive data against evolving cyber threats.
