Description:
FileVault is the macOS full-disk encryption feature. It uses XTS-AES-128 encryption with a 256-bit key to protect all data stored on the Mac startup disk. When FileVault is enabled, the entire contents of the drive are encrypted and only users with the correct login password or a valid recovery key can access the data. FileVault is built into macOS and is managed through System Settings.
Rationale:
Without disk encryption, data stored on a lost or stolen Mac is fully accessible to anyone who can remove the drive or boot from an external source. FileVault ensures that even if a device is physically compromised, the data remains unreadable. This is a fundamental control for protecting sensitive organizational and personal data on macOS devices.
Impact:
All data on the startup disk is encrypted and protected from unauthorized physical access.
Protects data if the device is lost, stolen, or decommissioned.
Meets compliance requirements for data protection (HIPAA, PCI DSS, ISO 27001, SOC 2).
A recovery key is generated during setup — must be stored securely.
Initial encryption can take several hours on older Intel Macs. On Macs with Apple silicon or a T2 chip, FileVault turns on almost immediately.
Default Value:
By default, FileVault is not turned on unless it was enabled during Mac setup (recent macOS versions offer to turn it on in Setup Assistant). Macs with Apple silicon or a T2 chip always encrypt the internal drive in hardware, but the data is not protected by the user’s password until FileVault is turned on.
Pre-Requisite:
macOS 11 Big Sur or later. (The menu path differs between macOS 13 Ventura and later and macOS 12 Monterey and earlier — both are shown below.)
Administrator privileges on the device.
Sufficient battery level or connected to power before enabling.
Secure location to store the FileVault recovery key.
Remediation:
Test Plan:
Pre-Implementation Check (run before making any changes)
Open Terminal (Applications > Utilities > Terminal) and check whether FileVault is turned on:
Expected on a non-compliant Mac: FileVault is Off. If it shows FileVault is On., FileVault is already enabled and no changes are needed.
Post-Implementation Check (run after completing the Implementation Steps)
Run the same command again:
Expected output: FileVault is On. If it also shows “Encryption in progress”, FileVault is on and is finishing encryption in the background — the Mac can be used normally while this completes.
You can also confirm in System Settings > Privacy & Security > FileVault, which should show that FileVault is turned on. On macOS 12 Monterey and earlier, System Preferences > Security & Privacy > FileVault shows the same status, as in the example below.
Screenshot: FileVault turned on with a recovery key set (System Preferences, macOS 12 Monterey and earlier).
Implementation Steps:
Before you start, connect the Mac to power.
Option A: Using System Settings (recommended)
Step 1: Open Privacy & Security
Click the Apple menu > System Settings, then click Privacy & Security in the left sidebar. On macOS 12 and earlier, go to System Preferences > Security & Privacy > FileVault and click the lock icon to make changes.
Step 2: Find FileVault
Scroll down to the FileVault section. If FileVault is Off, continue to Step 3.
Step 3: Turn on FileVault
Click Turn On (Turn On FileVault on macOS 12 and earlier), enter your administrator password if asked, and follow the on-screen prompts.
Step 4: Save the Recovery Key — MANDATORY
macOS asks how you want to unlock the disk if you forget your password. For business devices, choose the option to create a recovery key and not use an iCloud account. (Using an iCloud account is only suitable for personal Macs. On Macs managed by MDM, the key may be sent to IT automatically.)
macOS then shows the FileVault Recovery Key — a 24-character code made of letters and numbers. You MUST store this key in a safe location OUTSIDE the device. If you lose this key and forget your password, all data on the disk will be permanently inaccessible. Store it in one of these places:
Your organization’s MDM or IT administrator (key escrow) — recommended for business devices
A secure enterprise password manager
Written down and kept in a secure location offline
Step 5: Restart if asked
Older Intel Macs may ask you to restart to begin encryption. Encryption then continues in the background while you use the Mac. Run the Post-Implementation Check when the Mac is back up.
Option B: Using Terminal
Step 1: Turn on FileVault
Enter your administrator password, then enter the user name and password of the account that should be able to unlock the disk when prompted.
Expected output: a line like Recovery key = 'XXXX-XXXX-XXXX-XXXX-XXXX-XXXX'. This key is shown only once.
Step 2: Save the Recovery Key — MANDATORY
Copy the recovery key immediately and store it outside the device, in one of these places. Do not save it in a file on the same Mac.
Your organization’s MDM or IT administrator (key escrow) — recommended for business devices
A secure enterprise password manager
Written down and kept in a secure location offline
Note: On some Macs a restart is needed to finish turning on FileVault. Run the Post-Implementation Check after the restart.
Backout Plan:
Step 1: Open the FileVault settings
Go to System Settings > Privacy & Security > FileVault (on macOS 12 and earlier: System Preferences > Security & Privacy > FileVault, then click the lock icon).
Step 2: Turn off FileVault
Click Turn Off and enter your password. Decryption runs in the background and can take several hours on older Intel Macs.
Alternatively via Terminal:
Run fdesetup status to check progress — it shows FileVault is Off. when decryption has finished.
Note: With FileVault off, anyone with physical access to the Mac can read its data. Turn it back on as soon as possible.
Note:
Store the FileVault recovery key in a secure location — it is the only way to recover data if the password is forgotten.
Encryption happens in the background and the Mac can be used normally during the process.
For business devices, the FileVault recovery key should be escrowed to your MDM solution or stored in a secure enterprise password manager — not in a personal iCloud account.