App and app users themselves generate information throughout the course of a session and this,
along with app-specific configuration data needs to be protected.
Configurations and/or rule sets for firewalls, gateways, intrusion detection/prevention systems, and filtering routers and authenticator content are examples of system information likely requiring protection. Thus, for data at rest, the DoD requires the app employs NSA-approved cryptography to protect classified information. Again, this could be achieved through the OS, but the app may provide that functionality if the OS cannot meet the requirements.