Technical controls enforce encryption at rest on all sensitive data stores
The encryption-at-rest technical facet enforces full-disk encryption on endpoint devices, addressing the data-protection half of what A.8.1 requires for user devices.
The technical facet turns on and centrally enforces storage encryption everywhere sensitive data rests, from full-disk encryption to encrypted backups.