If you are specifying requirements that a certain classification of data be encrypted while at rest (on storage), should the requirement be considered met if the data is stored on an live (turned on) system where all storage media has full disk encryption?
The storage is encrypted and will be protected if the system is turned off (let's ignore evil maid type attacks for the moment or freezing the memory to capture the key); however, while the system is on, the data is at risk because of the possibility of key loggers, malware, or other exposure that can result from security issues caused by the fact the system is simply active.
For example, if a laptop has full disk encryption and is turned on or it is in hibernation or sleep mode, should that data be considered encrypted? This has implications for protecting data on the front end and considerations in data breach reporting. If a thief stole a system which is not totally shut off, it may not be possible to gain direct interactive access due to password restrictions and brute force lockouts, but there might be network or hardware attacks which could allow for remote exploitation to gain local access, and thus to the "encrypted" data.
A more clear case of encryption at rest would be unmounting a encryption container or storing the file in an encrypted zip file (using a strong algorithm of course, like AES versus the weaker password protection on basic zip files). More obvious would be removing the hard drive or usb-connected media where the data is stored. Because the data would have to be actively unencrypted, this would seem to fully meet requirements for encryption at rest.
Therefore, what factors should one consider if evaluating full disk encryption as meeting encryption at rest data requirements?