5. Connect to the CLI to remove the encryption by using the USB Flash Drive option. The CLI  command provides no return when completed successfully, as shown in Example 8-2.  6. Verify by using CLI that encryption is enabled only through the key management server, as  shown in Example 8-3. Note:  The process to migrate from key server encryption to USB flash drive encryption is  similar to the process that is described in this section. Before disabling the key server  encryption, test all USB flash drives and verify that no error message is created during the  test. Disable key server encryption by using CLI, as shown in the following example: chencryption -keyserver disable  If no other encryption method is configured, the system refuses to disable key server  encryption with the following error message: CMMVC8531E Encryption cannot be disabled while functions are configured to use  encryption. Disabling encryption is a disruptive process that included the requirement that all volumes  and the array from the FlashSystem 900 must be removed. Enabling encryption is under the  assumption that data should remain encrypted after the decision for encryption was made.  At system start on an encrypted system, the encryption key must be provided by an outside  source so that the system can access the data. The encryption key is read from the USB flash  drives that store copies of the keys or from the configured key server.  If you want the system to restart automatically, a USB flash drive with the encryption key must  remain inserted in each canister, so that both canisters can access the encryption key when  they start. As an alternative, the encryption key can be provided by the key server, which  eliminates the need for a physical USB flash drive. When the USB flash drive is used to unlock the FlashSystem 900 at start, the physical  environment must be secure so that no unauthorized person can copy the encryption keys on  the USB flash drives and gain access to data stored on the system. Chapter 8. Configuring settings  311 Working with an encrypted FlashSystem 900 Disabling encryption Example 8-3 Verifying that encryption is enabled on through the key management server Example 8-2 CLI command > chencryption -usb disable > lsencryption status disabled error_sequence_number usb_rekey no_key usb_key_copies 0 usb_key_filename usb_rekey_filename keyserver_status enabled keyserver_rekey no keyserver_pmk_uid KEY-fef5bae-d985347e-65d3-4343-86b4-1a1bdb4f666c keyserver_pmk_rekey_uid