Patent ID: 8700898

Claim:
A method for providing sensitive data protection in a virtual computing environment, the method executed by a processing device configured to perform a plurality of operations, the method comprising: activating a guest virtual machine in the virtual computing environment, wherein the guest virtual machine comprises a local sensitive data control agent, wherein the guest virtual machine is associated with a virtual appliance machine that administers sensitive data controls for the virtual computing environment, and wherein the virtual appliance machine comprises a sensitive data control monitor; generating a certificate that uniquely identifies the guest virtual machine; identifying, at the sensitive data control monitor, a sensitive data protection policy for the guest virtual machine; associating, at the sensitive data control monitor, an encryption key with the certificate, wherein the encryption key is generated in accordance with the identified sensitive data protection policy; and passing the generated encryption key, the sensitive data protection policy, and the certificate from the virtual appliance machine to the guest virtual machine, wherein sensitive data stored by the guest virtual machine is encrypted on a virtual disc of the guest virtual machine using the generated encryption key and the sensitive data protection policy and encryption of the sensitive data is maintained when the guest virtual machine is deactivated.