Three weeks after go-live, the security department mandates encryption at rest on the production appliance - which is now full of live backup data. A colleague claims only backups written from now on can ever be encrypted. What is the accurate plan?

DD Encryption can be enabled on a populated system without erasing anything. Once enabled, every segment entering the system through NFS, CIFS, DD VTL, DD Boost, or the NDMP TapeServer is encrypted after deduplication and local compression, before it is written to disk. Data stored before enablement is not encrypted automatically: the administrator selects the option to apply encryption to existing data (or later runs filesys encryption apply-changes followed by a cleaning run), restarts the file system, and the existing data is encrypted during the next cleaning cycle. Applications see only the short interruption of the file system restart, so the work fits a normal change window. The claim that only new writes can ever be encrypted describes what happens when the apply-to-existing option is skipped, not a limit of the platform, and letting old data age out would leave unencrypted backups on disk for their whole retention. A frozen maintenance weekend with backups paused misdescribes the mechanism: the conversion rides the background cleaning process rather than an offline outage. Migrating to a second system and decommissioning the original is unnecessary, because encryption is a licensed feature enabled in place. Exam caveat: plan cleaning capacity and the key manager before enabling, and record the passphrase handling under security-officer controls. Operational check: after the next cleaning cycle, verify the encryption status shows enabled and that existing data has been processed.