Self-Hosted MongoDB Encryption (At Rest) Best Practices?

Any pointers to accepted best practices for MongoDB encryption (in particular, at-rest encryption) to comply with major security guidelines (HIPAA, SOC2, …)? Is at-rest encryption better done at the database or file-system level?