[PCI-DSS] 3.4.1 If disk encryption is used (rather than file- or column-level database encryption), logical access must be managed independently of native operating system access control mechanisms (for example, by not using local user account databases). Decryption keys must not be tied to user accounts.

[msegarra]

There are many clients are not using disk encryption, but in SAQ or the audit procedures is not permitted the "Not Applicable" indication. So, what is the best option? a) check as compliant b) check as not compliant and write a comment on the "Special*" field.

Thanks!

[mfarid]

we are using NetAPP Decru Solution which is encrypting the Disks presented to the servers from HP EVA Storage ...

controlling the encryption and the accessing is being done by the Decru administrators who are using System Cards and username/password to access the decru system ...

is this comply with Req. 3.4.1 ?

If disk encryption is used (rather than file- or column-level database encryption), logical access must be managed independently of native
operating system access control mechanisms (for example, by not using
local system or Active Directory accounts). Decryption keys must not be tied to user accounts.

[tim_holman]

From what I understand, DeCru's solution does not encrypt hard drives. It's a transparent solution that goes in front of the protected resource/NAS and encrypts network/application traffic in transit.
I did look at their website, but unfortunately precise architecture or detailed deployment examples do not appear.
You still need to encrypt local hard drives to meet 3.4.1, to mitigate the risk of theft and unauthorized local access.
DeCru still adds value in ensuring you can only access the data at rest by using encryption keys that the DeCru appliance manages and perhaps you could compensate your way around 3.4.1 with stricter local access policies and physical security.
Note that as DeCru encrypts everything going to and from the protected resource, you will need a backup system that supports this. You can't get around it with a locally attached encryption solution as this could still be storing cardholder data in clear text.