SED and FIPS Drives Explained: Self-Encrypting Storage for Compliance
What self-encrypting drives (SED) actually do, how FIPS 140-2 validation differs, when compliance requires them, and what to check before buying — controller support, key management, and secure erase.
TL;DR — SED encrypts in hardware; FIPS is the government-validated version
A Self-Encrypting Drive (SED) encrypts every byte written to media using a hardware AES engine on the drive itself, with zero performance cost. A FIPS 140-2 (or 140-3) validated drive is an SED whose encryption implementation passed NIST certification — required for US federal, defense, and many healthcare/finance contracts. SEDs only enforce protection when locking is enabled through a controller or software that manages the keys; an unmanaged SED still encrypts, but behaves like a normal drive. Crypto-erase makes decommissioning instant on both.
---
How a self-encrypting drive works
Every SED contains an AES-256 engine in the drive controller ASIC. Data is always encrypted on media with a Data Encryption Key (DEK) generated inside the drive. What compliance actually cares about is the Authentication Key (AK) layer:
- Unmanaged (out of the box): the drive encrypts everything, but unlocks itself at power-on. Protection against a stolen drive — none in practice.
- Managed / locked: a RAID controller (PERC, Smart Array), HBA, or software (SEDutil, array firmware) sets the AK. Now the drive refuses to return data until unlocked at boot — a stolen drive or decommissioned unit is cryptographically unreadable.
Because encryption always runs in hardware, enabling locking costs zero throughput and zero latency — unlike software encryption layers.
SED vs FIPS 140-2 — what the certification adds
FIPS 140-2/140-3 validation means NIST-accredited labs verified the drive's crypto module: algorithm correctness, key handling, tamper evidence (level 2 adds physical tamper seals). Functionally, a FIPS drive and its non-FIPS SED sibling are usually the same hardware — the FIPS version costs more and carries the certificate number.
Who needs FIPS: US federal agencies and contractors (FISMA), defense supply chain, state government, and any contract that cites FIPS 140-2 for data at rest. Who just needs SED: HIPAA, PCI-DSS, SOX and most corporate policies say "encrypted at rest" without naming FIPS — a standard SED (often TCG Enterprise/Opal) satisfies them.
What to check before you buy
- Controller support. PERC (H730 and later) and HPE Smart Array both manage SED locking natively; older HBAs pass drives through unmanaged. In storage arrays (PowerVault, MSA, Compellent), SED support is a licensed array feature — verify before populating shelves.
- TCG protocol family. Enterprise SAS SEDs speak TCG Enterprise; client/SATA drives speak TCG Opal. Controllers support specific families — match them.
- Part-number suffix. OEM names state it: Dell and HPE listings include "SED" or "FIPS" in the drive description; Seagate encodes it in the ST-number variant. If the product name does not say SED, assume it is not.
- Mixed arrays. You can mix SED and non-SED drives, but the virtual disk is only "secured" if every member is SED-capable.
Crypto-erase — the underrated benefit
Decommissioning a normal drive means hours of overwriting or physical shredding per unit. On an SED, revert/crypto-erase regenerates the internal DEK in about one second, rendering all prior data permanently unreadable — NIST SP 800-88 accepts cryptographic erase for media sanitization. For fleets that cycle hundreds of drives, this alone justifies the SED premium.
FAQ
Does an SED protect against ransomware or a hacked OS? No. Once the drive is unlocked at boot, it serves data normally to whatever the host asks. SED protects data at rest — stolen, resold, or RMA'd drives — not live systems.
Can I use a FIPS drive without enabling any of it? Yes. Unmanaged, it behaves exactly like a standard drive. Many refurbished FIPS drives live perfectly ordinary second lives in labs that never touch the crypto features.
Is a used SED safe to buy? Yes — a crypto-erased SED is mathematically clean. It also means data recovery from a drive you crypto-erase is impossible, so manage keys carefully in production.
---
Pro Disk Network stocks SED, Self-Encrypting, and FIPS 140-2 validated SAS drives across Dell, HPE, and Seagate lines — the security variant is always stated in the product name. Browse SAS hard drives or email sales@prodisknetwork.com with your compliance requirement and controller model; we will match validated part numbers, including for government purchase orders.
Related: 512e vs 4Kn vs 512n Sector Formats · Dell PowerEdge SAS Drives · Enterprise Procurement