HowyGuard

How do I encrypt my computers and business data?

Howy the walrus sealing an envelope with wax

Turn on BitLocker or Device encryption on every Windows computer and FileVault on every Mac, save each recovery key away from the computer, set a passcode on every phone with work email, and encrypt backup drives. If your form also asks about servers or data files, ask whoever holds your business records, in writing, whether they're encrypted.

Encryption scrambles data so only someone with the password or key can read it.

Check if you already have it

  • Windows: open Settings, then Privacy & security, and look for Device encryption set to On. If that isn't there, click Start, type Manage BitLocker and see whether the C: drive says BitLocker on.
  • Mac: open System Settings, then Privacy & Security, and scroll to FileVault. It should say it's turned on.
  • Phones: every phone with work email should have a passcode or screen lock.
  • Backup drives: Time Machine's Encrypt Backup should be on.
  • Business records: if your form asks about servers, databases or data files, write down where your records live. If that's an online system, ask the company in writing whether your data is encrypted, and keep their answer.

Check every laptop and desktop the business uses, including any that go home.

How to set it up

First decide where the recovery keys will live: a business password manager, or a printed copy in a locked drawer. Never on the same computer.

On each Windows computer:

Encrypt the drive with BitLocker or Device encryption

Windows, needs an administrator account and a safe place for the recovery key

  1. Open Settings, then Privacy & security. If you see Device encryption, open it and turn it On.
  2. If you don't see it, click Start, type Manage BitLocker and open it. Click Turn on BitLocker next to the C: drive.
  3. When asked how to back up the recovery key, save it to your Microsoft account or print it. Store it away from the computer.
  4. Choose Encrypt used disk space only on a new computer, or Encrypt entire drive on one that has been in use.
  5. Let it finish. You can keep working while it runs.
  6. Repeat on every laptop and desktop the business uses.

How to show it's true: Screenshot the Device encryption or BitLocker page showing it's on, with the computer name and date noted.

If you get stuck:
  • Neither option shows up: this is likely Windows Home on hardware that doesn't support Device encryption. Moving to Windows 11 Pro adds BitLocker. A tech can check.
  • You can't find the recovery key later: go to account.microsoft.com/devices/recoverykey and sign in with the account you saved it to.

On each Mac:

Encrypt the Mac with FileVault

Mac, needs an administrator account and a safe place for the recovery key

  1. Open System Settings, then Privacy & Security.
  2. Scroll to FileVault and click Turn On.
  3. Choose how to unlock if you forget your password. Writing down the recovery key and storing it away from the Mac is safest for a business.
  4. Let encryption finish. You can keep working while it runs.
  5. Repeat on every Mac the business uses.

How to show it's true: Screenshot the FileVault section showing it is on, with the Mac name and date noted.

If you get stuck:
  • The button is greyed out: you need an administrator account. Ask whoever set up the Mac, or a tech.

On an iPhone that gets work email, set a passcode. Apple says that also turns on the phone's encryption. On an Android phone, set a screen lock, and ask a tech to confirm encryption is on if you can't find it in Settings.

For backup drives, turn on Encrypt Backup in Time Machine on a Mac. On Windows editions that include BitLocker, BitLocker To Go can encrypt a USB drive.

How to show it's done

Take one screenshot per computer showing encryption on, with the computer's name and the date. Write down where each recovery key is kept, but not the key itself. Add any written answer from your records provider, and file it all in your proof folder.

Common questions

Half my laptops are done. What do I answer?

Some forms offer "sometimes" or "partly". Use it until every computer is done, then answer yes.

What if I lose the recovery key?

On Windows, if you saved it to your Microsoft account, sign in at account.microsoft.com/devices/recoverykey. On a Mac, it's wherever you stored it when you turned FileVault on.

Neither option shows up on my Windows laptop. What now?

That's usually Windows Home on a computer without Device encryption. Moving to Windows 11 Pro adds BitLocker. A tech can check which route fits.

Sources

  1. Microsoft Support: Device encryption in Windowssupport.microsoft.com
  2. Microsoft Support: BitLocker drive encryptionsupport.microsoft.com
  3. Apple Support: Protect data on your Mac with FileVaultsupport.apple.com
  4. Apple iPhone User Guide: Set a passcode on iPhonesupport.apple.com
  5. Canadian Centre for Cyber Security: Using encryption to keep your sensitive data secure (ITSAP.40.016)cyber.gc.ca

Related