Guide · Device security

Turn on disk encryption for every laptop

By Christopher Smith, MS Cyber Security, penetration tester·Published October 18, 2026·Updated October 18, 2026·5 min read

Disk encryption does one job: if a laptop is lost or stolen, whoever finds it cannot simply remove the drive or boot around the login to read your files. The Short says turn it on before the device leaves the box. This guide covers the order to do it in, where recovery keys must live, and the small-team checks that keep encryption from becoming a lockout story.

Quick verdict

• Every laptop, by default. BitLocker on supported Windows editions, FileVault on Mac — on before the device is handed over, not after its first trip.
• Recovery keys go in the vault. Store each key in your team password manager against the device record. Not a sticky note, not a photo on someone's phone.
• Verify, don't assume. Check encryption status on the device itself and record it in your device list.

How to turn it on

Windows — BitLocker

1. Search 'Manage BitLocker' in Settings/Control Panel on a supported Windows edition and turn it on for the system drive.
2. Save the recovery key to your password vault entry for that device (you can also keep an approved offline copy under your recovery policy).
3. Restart if prompted and confirm BitLocker reports the drive as encrypted.

Mac — FileVault

1. Open System Settings → Privacy & Security → FileVault and turn it on.
2. Choose a recovery method you control as a business and store the personal recovery key in the vault entry for that device.
3. Let encryption complete and confirm FileVault shows as on for the drive.

Edition and hardware requirements vary, so if a device does not offer encryption, treat that as a replacement or upgrade decision — do not quietly exempt the laptop that travels most. Pair encryption with endpoint protection and a short screen-lock timeout; encryption protects a powered-off device, the lock protects a running one.

Recovery keys: the part that saves you later

• Create one vault entry per device: make/model, serial, assigned user, encryption status, and the recovery key.
• Test your process with one device: have a second staff member retrieve the key from the vault. If only one person can ever find keys, fix that now.
• When a device changes hands, confirm encryption is still on and the key in the vault still matches that machine.
• When a device is retired, keep or destroy keys according to your data policy — and record which you did.

A small-team rollout checklist

1. List every laptop and owner.
2. Check each device's encryption status; turn it on where missing.
3. File every recovery key in the vault.
4. Add 'encryption on + key filed' to your new-device setup and to offboarding, so returned laptops are checked before reissue.

Bottom line

Every laptop, by default. BitLocker on supported Windows editions, FileVault on Mac — on before the device is handed over, not after its first trip. The expanded steps above turn the Short's rule into a process with an owner and a check — do the first section today, schedule the rest this week, and write down what you changed so the next person does not have to rediscover it.

Free next step: Get the Small Business Cybersecurity Checklist — download it now, or sign up there to get it by email and hear about new guides.