How to check BitLocker and FileVault before a laptop leaves the office
A lost or stolen laptop is a routine event for a business with 5 to 50 staff, and encryption decides whether it is a replacement cost or a personal data breach. This guide covers how to confirm BitLocker on Windows and FileVault on Mac, where to keep recovery keys, how to prove it to an insurer or assessor, and what to do when someone leaves.
Key practical checks for owners
- ✓Check that encryption has finished, not just started, on every laptop before it is handed over.
- ✓Keep each recovery key in a place the laptop user cannot reach and a named administrator can.
- ✓Record the check per device so you can show an assessor or insurer evidence rather than a statement.
- ✓Treat a leaver's laptop as a data-handling task: collect, verify, then wipe or re-issue.
Why unencrypted laptops are the first thing to fix
A laptop left on a train or taken from a car boot carries client files, saved browser sessions and cached email. With full-disk encryption switched on and the device powered off, the drive contents are unreadable without the user's credentials or a recovery key. Without it, anyone can remove the drive or boot from a USB stick and copy everything.
Under UK GDPR the question after a loss is whether personal data was exposed. A properly encrypted device is a strong argument that the ICO does not need notifying, because the data was not accessible. An unencrypted one usually means assessing the risk to individuals and possibly reporting within 72 hours. Cyber Essentials also expects data on laptops to be protected, and insurers increasingly ask about encryption on proposal forms.
Checking BitLocker on Windows laptops
BitLocker is included in Windows Pro, Enterprise and Education. Windows Home does not include full BitLocker, though some Home laptops offer a simpler feature called device encryption. If any staff laptops run Home, upgrade them to Pro before relying on them for business data.
Check the state on each device rather than assuming the setup worked. The status must read as fully encrypted with protection on. A drive showing encryption in progress, or protection suspended after an update, is not protected yet.
- 1Select Start, type Manage BitLocker and open the result.
- 2Under Operating system drive, confirm it says BitLocker on.
- 3For a quick command-line check, open Windows Terminal as administrator and run manage-bde -status.
- 4Confirm Conversion Status reads Fully Encrypted and Protection Status reads Protection On.
- 5If protection is suspended, select Resume protection and recheck.
- 6If you use Microsoft Intune, open the Intune admin centre, go to Devices, then Monitor, then Encryption report to check every laptop at once.
Checking FileVault on Mac laptops
FileVault is built into macOS and works on every supported Mac. It is often on already because the setup assistant offers it, but staff can decline or skip it, so verify rather than assume. On a Mac with Apple silicon or a T2 chip the disk is encrypted by default, though FileVault is still what ties decryption to the user's login and gives you a recovery key.
Check each Mac in System Settings, and confirm the recovery method chosen. Avoid the option to store the key with an individual's Apple ID, because the business then loses control when that person leaves.
- 1Open the Apple menu, then System Settings.
- 2Select Privacy & Security and scroll to FileVault.
- 3Confirm it says FileVault is turned on for the disk.
- 4If it is off, select Turn On, choose a recovery method and note that encryption continues in the background.
- 5For managed Macs, confirm the MDM profile enforces FileVault and escrows the personal recovery key to the business.
Where recovery keys should be held
A recovery key is the only way back in if a user forgets a password, a hardware change triggers a lockout or a leaver cannot be reached. It is also the way into the drive for anyone who gets hold of it, so it needs the same care as an administrator password. Keys printed and taped inside a laptop bag, or saved in a file on the same laptop, defeat the purpose.
For Windows, store keys in Microsoft Entra ID or Active Directory so an administrator can retrieve them, or in your password manager with restricted access. For Mac, escrow keys to your MDM or record them in the business password manager. Keep a named owner for this, usually the person who looks after IT, and a second administrator who can step in.
- Each laptop has a recovery key recorded against its serial number.
- Keys are stored in an administrator-only location, not on the laptop or in a shared spreadsheet.
- At least two named people can retrieve a key.
- The user has not been given a copy unless the business policy says so.
- Key retrieval is logged or at least recorded when it happens.
A pre-issue checklist you can keep as evidence
Run the same short check every time a laptop is issued, whether new, reallocated or returning from repair. A one-page form per device is enough, and a spreadsheet works for a small team. The value is in being able to show an assessor, insurer or client that encryption was verified on a date by a named person, rather than stated as policy.
Do the check before the laptop leaves the building, since fixing encryption on a device already in someone's home is slower and often skipped.
- Device make, model, serial number and assigned user.
- Operating system and edition (Windows Pro or Home, macOS version).
- Encryption status confirmed as fully encrypted, with the date and who checked.
- Recovery key stored and location recorded, without writing the key itself in the form.
- Screen lock timeout and a login password or PIN set.
- Disk encryption setting enforced by policy where you use Intune or another MDM.
Handling a leaver's laptop
When someone leaves, collect the laptop on or before their last day and keep it powered off and stored securely until you process it. Before doing anything else, disable the person's accounts and revoke their access to email, cloud storage and the password manager, so a retained login cannot reach business data from another device.
Then decide whether the laptop is re-issued or retired. To re-issue, back up any business files the leaver held, wipe the device by resetting Windows or erasing the Mac, and set it up fresh with a new encryption key recorded against the new user. To retire it, wipe it the same way before it is sold, donated or recycled, and keep a record of the date. If the leaver ever used a personal Apple ID or Microsoft account on the device, remove it so activation lock or account binding does not block the next user.
- 1Disable the leaver's Microsoft 365 or Google account and reset their password manager access.
- 2Collect the laptop and any chargers, tokens and security keys.
- 3Retrieve and note the recovery key only if you need to access data before wiping.
- 4Back up business files to the company's storage.
- 5Wipe the device: on Windows use Reset this PC with Remove everything, on Mac use Erase All Content and Settings.
- 6Re-enable encryption for the next user, verify it and record the new key.
Common questions
- Is BitLocker or FileVault enough to meet UK GDPR expectations for laptops?
- Full-disk encryption is a widely accepted technical measure for portable devices and makes a lost laptop far less likely to be a reportable breach. It is not the whole answer. You still need strong login passwords, a short lock timeout, controlled recovery keys and a record showing it was checked. Regulators look at the whole set of measures, not encryption alone.
- Do Windows Home laptops support BitLocker?
- Windows Home does not include full BitLocker management. Some Home devices offer a limited feature called device encryption if the hardware supports it, but you lose the central recovery-key control and reporting a business needs. The practical fix is to upgrade those laptops to Windows Pro before they hold business data.
- What happens if we lose the recovery key and the user forgets their password?
- The data on the encrypted drive is unrecoverable, which is the point of encryption. You would have to wipe the laptop and restore from backup. This is why keys must be stored centrally when the device is set up, and why backups of business files matter independently of encryption.
- Should staff keep their own recovery key in case something goes wrong?
- Generally no. If the user holds the key, a thief who steals the laptop bag may get both. Keep the key with a named administrator or in your device management system, and release it only after confirming the requester is the genuine user. Some businesses allow a sealed copy in a safe for a small team, with access logged.
- Do we need to encrypt desktops and external drives as well?
- Fixed desktops in a locked office carry lower theft risk, but encrypting them costs little and protects against break-ins and disposal mistakes. External drives and USB sticks that hold business data should be encrypted too, using BitLocker To Go on Windows or an encrypted APFS volume on Mac, or banned from carrying client data altogether.
- How often should we recheck encryption on laptops already in use?
- Recheck at least quarterly, and after major operating system updates, hardware repairs or motherboard replacements, which can suspend or reset BitLocker protection. If you use Intune or another MDM, schedule the encryption report to be reviewed monthly so a drive with protection off is caught quickly.
Related UK cybersecurity guides
How Often Should a Small Business Test Its Backups? A Monthly and Quarterly Routine
A backup that has never been restored is an assumption, not a control. This guide sets out a monthly spot check and a quarterly full restore for a business of 5 to 50 staff, with the named evidence to keep so a manager, assessor or insurer can see the routine is real.
What to do when an old Windows computer cannot be replaced yet
Some businesses run a line-of-business application that only works on an old Windows computer. Once Microsoft stops issuing security updates, that machine is an unsupported device. This guide covers how to isolate it, restrict who and what can reach it, record a replacement date and understand why compensating controls reduce risk without making the device compliant for Cyber Essentials.
Cyber Essentials firewall requirements for offices, routers and home workers
Cyber Essentials expects every in-scope device to sit behind a correctly configured firewall, whether that is a router in the office or the software firewall on a home worker's laptop. This guide explains where the line falls for home routers, what a compliant configuration looks like, and which records an assessor is likely to ask for.