Turn on full disk encryption on every company laptop, store the recovery key somewhere other than the laptop, and keep a simple record that shows each device is encrypted. On Macs that means FileVault. On Windows it means BitLocker or device encryption. A lost laptop then becomes a hardware problem, not a data breach.
Why this is the first laptop control
Laptops get lost in taxis, airports and shared flats. If the disk is not encrypted, whoever finds it can read it. If it is encrypted and locked, they mostly cannot. This is cheap, built in, and easy to explain to a customer.
Macs: FileVault
Apple's documentation says Macs with Apple silicon or a T2 chip already encrypt data automatically. FileVault adds protection by keeping others from decrypting your data without your login password. Macs without those chips must turn FileVault on to be encrypted at all.
The part teams get wrong is recovery. Apple's guide describes two options: an iCloud account, or a recovery key. If you lose both your login password and your recovery key, your files are lost for good. A business can also set a recovery key. Decide which one you use, and write it down.
The recovery key should be stored somewhere other than the encrypted startup disk, and not with the Mac. A shared team vault with restricted access works well.
Windows: BitLocker and device encryption
Microsoft describes BitLocker as whole volume encryption that addresses data theft or exposure from lost, stolen or decommissioned devices. It works best with a TPM, a hardware component common on Windows devices. Microsoft says the password only option on devices without a TPM is discouraged, because it can be brute forced.
Device encryption turns BitLocker on automatically on qualifying devices. Where the recovery key goes depends on how the device is set up. Microsoft's page says it is backed up to Microsoft Entra ID or Active Directory for joined devices, or to a Microsoft account with administrative rights otherwise. If a device uses only local accounts, it stays unprotected even though the data is encrypted, because the recovery key is never backed up. That is a good reason not to use local accounts on company machines.
Windows Pro and Enterprise editions support BitLocker enablement. Check that nobody bought Home edition laptops for the team.
The checklist
- Turn on FileVault or BitLocker before the device holds any company data.
- Choose where recovery keys go and who can read them. Two people should be able to, not one.
- Do not keep the recovery key on the same laptop or in a tool that needs that laptop to open.
- Record the check: a screenshot or a device report, with the date and device serial.
- Repeat the check each quarter, and whenever someone gets a new laptop.
- Wipe or recycle old devices properly. Encryption helps here too, since Microsoft notes it renders data inaccessible when protected devices are decommissioned.
What encryption does not cover
Encryption protects a powered off or locked device. It does not help if the laptop is stolen while unlocked, or if malware runs under a logged in user. Pair it with a screen lock timeout and a short plan for a lost device.
Quick check
Do we need FileVault if the Mac has Apple silicon?
Apple says these Macs encrypt data automatically, and FileVault adds the login password barrier on top. Turn it on anyway and set up recovery, so you control how a locked out user gets back in.
Where should the recovery key live?
Somewhere that is not the laptop, with access limited to two or three named people and logged where possible.
Sources
Last reviewed: 19 October 2026.
