Cigent protects data on devices operating at the edge from unauthorized access. Cigent solutions secure data at rest with layered protection: hardware encryption, pre-boot authentication, and multifactor authentication, and protect data integrity in use, preventing wiping, cloning, and other data attacks.

Pre-Boot Authentication

Q: How does Cigent work?

Defeating a sophisticated adversary requires layered protection. The foundation is AES-256 full drive hardware encryption with pre-boot and multifactor authentication, validated by agencies including NSA and NIAP. Cigent adds lifecycle integrity capabilities including hidden partitions, storage-embedded AI, and verified data erasure.

Q: What is data-at-rest encryption?

Data at rest encryption traditionally refers to the encryption of data when the device is asleep or powered-off. Data at rest encryption seeks to prevent adversaries who gain physical access to the device would seek to extract sensitive data. Cigent uses AES 256 full drive hardware encryption with pre-boot and multifactor authentication. In addition, Cigent uses zero-trust access to control to also protect data when a device is in use. This is with hidden partitions that maintain encryption until it is accessed with step-up authentication.

Q: What is pre-boot authentication?

Pre-boot authentication (PBA), also known as power-on authentication, is a security feature that requires users to authenticate before their device boots up. PBA is a layered approach that protects devices and data from offline attacks and cyberattacks. It’s often used with full disk encryption (FDE), where users must authenticate to boot the system and restore data. Cigent PBA 2.0 is NIAP Common Criteria certified, Cigent components are listed on the NSA CSfC Components List for data at rest, and Cigent cryptographic modules are validated under FIPS 140-2 and 140-3.

Q: What devices does Cigent protect with hard drive encryption?

Cigent provides the widest breadth of secure storage solutions all utilizing hardware encryption. These includes: PCs supporting both M.2 2280 and the emerging M.2 2230 standard, remote servers and NAS devices with U.2 drives, external media with flash drives, encrypted external drives, SD and Micro SD cards, and embedded for SSD BGA.

Q: Does Cigent help with certifications?

Cigent secure storage and Software Full Drive Encryption are listed on the NSA CSfC Components List for data at rest, including the Pre-Boot Authentication requirement. Cigent cryptographic modules are validated under FIPS 140-2 and 140-3, and Cigent capabilities support Executive Order 14028 requirements including encryption of data at rest, multifactor authentication, and zero trust access control.

Cigent Pre-Boot Authentication (PBA) requires validated credentials before any operating system loads, so the drive releases nothing to a machine that has not proven its user. PBA 2.0 is NIAP Common Criteria certified and listed on the NSA CSfC Components List, serving as the authentication gate of the outer layer in CSfC Data at Rest architectures.

Schedule a Demo

Outer Layer CSfC for DAR Solution

A self-encrypting drive does not protect data on its own if it decrypts at power-on. Cigent PBA requires authentication before any operating system loads, in its own secure pre-boot environment, and the drive releases its encryption key only after credentials are validated. Together, the drive and its PBA form the outer layer of the two-layer architecture required by the NSA CSfC Data at Rest Capability Package v5.1.0, one layer, completed by independent software full drive encryption as the inner.

Required Protection

Cigent Pre-Boot Authentication (PBA) provides a separate, secure authentication environment before the operating system boots, significantly reducing system vulnerabilities and unauthorized access risks.

Meet CSfC DAR Requirements

Meet CSfC DAR Requirements: PBA pairs with CSfC-listed hardware full drive encryption to form the outer layer required by the NSA CSfC Data at Rest Capability Package.

Multi-Factor Authentication Ready

Supports single and multiple authentication factors, including username/password, smartcards (PIV), and Security Keys, ensuring comprehensive and robust authentication aligned with federal standards.

Independent Layered Protection

Operates independently from software encryption solutions, ensuring the cryptographic and functional isolation mandated by CSfC architectural requirements.

Administration at Scale

Cigent's command-line interface (CLI) utility provides management of PBA with ability to integrate into existing enterprise management.

Wide Device Compatibility

Supports deployment on various endpoints including Intel/AMD/ARM (NVIDIA Jetson Orin) laptops, desktops, workstations, and servers.

Advanced Data Protection

Comprehensive Encryption and Authentication Solutions

Hardware Full Drive Encryption (HW FDE) combined with PBA. This is the outer layer of the dual-layer encryption approach mandated by the Commercial Solutions for Classified (CSfC) Data-at-Rest (DAR) program and provides the first layer of defense. It includes:

AES-256 Hardware EncryptionProvides robust encryption, safeguarding keys from interception.
Pre-Boot Authentication (PBA)Secure login before the operating system loads, defending against boot-level threats.

How Cigent PBA Protects your Data

Cigent PBA safeguards sensitive data through robust hardware-based encryption, enforcing pre-boot authentication requirements as mandated by the NSA CSfC DAR Capability Package. This ensures compliance and protection of mission-critical data at rest.

Device Powered Off
All data remains encrypted, unreadable, and inaccessible.
Pre-boot Authentication
Upon powering on the device, authentication via supported methods, including username/password, smartcards (PIV), or Security Keys, is required before the operating system boot sequence, establishing secure access controls before any data is decrypted.
Authentication Boot
Once authentication is successful, the operating system boots, and the drive’s encrypted data becomes accessible to the authorized user.

The Cigent Advantage

Cigent solutions were designed and developed with and for US Intelligence and Defense communities. All employees, including Cigent software development, are based in the US. The team includes multiple personnel with TS/SCI clearance with decades of data protection and operational experience to support your requirements.

Cigent solutions have been tested and validated by leading Federal agencies including MITRE, NIST, NSA, NIAP, the Air Force, Cyber Resilience of Weapon Systems (CROWS), and NSSIF (UK) and are deployed across US Intelligence agencies, US Defense services, and the defense industrial base.

eBook

Protect Your Data at Rest

Cigent is prepared to support your mission, navigating the complex compliance requirements to protect data at the edge. Its solutions were developed for and with US Federal agencies with deep expertise in data protection. Read our extensive eBook to learn more.

Download eBook Now

The Latest from Cigent

View All

What Is CSfC and How the NSA Program Actually Works

Blog

October 20, 2026

Frequently Asked Questions

What does Cigent do?

How does Cigent work?

What is data-at-rest encryption?

What is pre-boot authentication?

What devices does Cigent protect with hard drive encryption?

Does Cigent help with certifications?

Still have Questions?

Learn how to secure mission-critical and classified data across the battlespace.

Download eBook

Cigent’s Federal Data Protection Solutions are second to none

Learn more about how Cigent can help you achieve your mission and protect data at rest and data on the edge from all forms of attack.

Schedule a Demo

Encrypted Storage Solutions

Software Protection

Resource Types

Webinars & Events

Recent Posts

Categories