FileVault Mac Encryption: Should Your Business Turn It On?
FileVault is the full-disk encryption built into every Mac. When it's on, everything on the drive is scrambled until someone types the login password, so a lost or stolen Mac is just an expensive paperweight to whoever has it. For a business, the answer to "should I turn on FileVault?" is yes, every time. The real question is who keeps the recovery key.
A laptop thief doesn't want your MacBook. They want what's on it. FileVault makes sure the only thing they get is the MacBook. (Which, to be fair, is still a nice MacBook. I'm told they resell well.)
TL;DR: Turn on FileVault on every company Mac. It takes about a minute to start, runs in the background, and has almost no performance cost on modern Macs. Store the recovery key in your device management system, not in an employee's personal iCloud. If you can't say where every company Mac's recovery key lives right now, that's the actual problem to fix.
What Is FileVault Disk Encryption on a Mac?
FileVault is Apple's whole-disk encryption. It encrypts the startup drive so the data can't be read without your login password or a recovery key.
Apple's own FileVault guide says it "provides an extra layer of security by keeping someone from decrypting or getting access to your data without entering your login password."
Microsoft's Intune documentation describes it the same way, as "a whole-disk encryption program included with macOS that uses XTS-AES 128-bit encryption." FileVault Mac encryption is free, it's built in, and it's been part of macOS for years. There's nothing to buy.
How FileVault Works on Apple Silicon and Intel Macs
Here's the part that confuses people. Apple says that Macs with Apple silicon or a T2 security chip have their data encrypted automatically. So why turn on FileVault?
Because without FileVault, that built-in encryption isn't tied to your password. The Mac can open its own drive at startup without asking anyone. With FileVault on, the password becomes part of the key. No password, no data.
On older Intel Macs without a T2 chip, there's no automatic encryption at all. Apple puts it simply: those Macs "need to turn on FileVault to encrypt your data." If you still have one of those in the office, it's the first one to fix.
Should I Turn On FileVault Disk Encryption? Yes or No
Yes. For a business, FileVault Mac encryption should be on for every laptop and desktop. Here's why, in plain terms.
Lost and stolen laptops. Encryption is what separates "we lost a laptop" from "we had a data breach."
Regulations expect it. HIPAA, the FTC Safeguards Rule, and most cyber insurance applications ask about laptop encryption.
It costs nothing. No license, no extra software.
Performance is a non-issue on Apple silicon. You won't notice it.
The one reason to hesitate is the recovery key. Apple's warning is blunt: "If you turn on FileVault and then forget your login password and can't reset it, and you also forget your recovery key, you won't be able to log in, and your files and settings will be lost forever." That's not a reason to leave it off. That's a reason to manage the key properly.
The $1,040,000 Stolen MacBook
If you want to know what skipping FileVault costs, look up the Lifespan case.
In 2017, an employee's MacBook was stolen from a car in a public parking lot in Rhode Island. It was never recovered. It wasn't encrypted. It held information on 20,431 patients. The HHS Office for Civil Rights settled with Lifespan for $1,040,000, and the investigation found the organization had not implemented "policies and procedures to encrypt all devices used for work purposes."
Same stolen laptop with FileVault on? Very different week. Laptops get left in cars and coffee shops constantly. Encryption is what makes that a hardware problem instead of a legal one.
How to Turn On FileVault on a Mac
Here's how to turn on FileVault on a single Mac, per Apple:
Open the Apple menu, then System Settings.
Click Privacy & Security, then scroll to FileVault.
Click Turn On and enter your password.
Choose how to get back in if you forget your password: your iCloud account, or a recovery key.
Click Continue. Encryption runs in the background while you work.
On a personal Mac, either recovery option works. On a company Mac, read the next section before you pick.
Can I Set Up FileVault Later?
Yes. If you skipped FileVault during setup, you can turn it on any time from System Settings. Nothing gets erased.
Encryption on a modern Mac usually finishes quickly. On older Intel Macs with lots of data it can take several hours, and the Mac needs to stay on and plugged in. You can keep working while it runs.
The risk of "later" is that later becomes never. I started on the bench at Circuit City, fixing whatever walked in the door. Pulling the drive out of a dead laptop and reading every file on another machine was a normal Tuesday. That's exactly what an unencrypted Mac still allows. FileVault is the thing that makes that trick stop working.
The Recovery Key Problem Nobody Talks About
This is the part the how-to guides skip, and it's the one that actually bites businesses.
When an employee sets up FileVault on a company Mac and chooses "use my iCloud account," the recovery path now runs through their personal Apple ID. When that employee leaves, so does the only way back into the drive if the password goes missing. You own the laptop. You don't own the way in.
Here's my one strong opinion on this: a business should always own the keys to its own systems. Domains, admin accounts, backups, and yes, encryption recovery keys. If getting into your own laptop depends on a former employee answering a text, that's lock-in, not security.
The fix is to escrow the keys in your device management system. Microsoft's Intune FileVault documentation explains that "Intune can escrow a copy of the personal recovery key," which lets admins rotate keys and lets users "recover a lost or rotated personal recovery key." Jamf, Kandji, and Apple Business Manager-based tools do the same job.
Managing FileVault Mac Encryption Across a Business
One FileVault Mac setup, you can handle by hand. Ten Macs, you need a system. With an MDM like Intune you can:
Force FileVault on every company Mac, including during first setup on macOS 14 and later.
Escrow and rotate recovery keys automatically.
Report encryption status for insurance forms and audits.
Block unencrypted Macs from company email and files with compliance policies.
That last one is the quiet hero. If a Mac isn't encrypted, it doesn't get Outlook. People turn FileVault on remarkably fast once Outlook is on the line. Our Intune MDM guide covers the setup.
How to Turn Off FileVault (and Why You Usually Shouldn't)
You can turn FileVault off in System Settings > Privacy & Security > FileVault > Turn Off. Decryption runs in the background like encryption did.
There are a few fair reasons: a Mac being wiped and sold, or troubleshooting with Apple support. "It feels slow" is not one of them. On a modern Mac, FileVault isn't why it's slow. Forty browser tabs are why it's slow.
When You Don't Need Us for This
Plenty of offices can handle FileVault on their own.
One to three Macs: turn it on, choose a recovery key, and store it in the company password manager.
Everyone already enrolled in an MDM that reports encryption: just confirm the policy is on.
Where it's worth getting help: a mixed fleet of Macs and PCs, regulated data, a cyber insurance form asking about encryption, or recovery keys sitting in former employees' iCloud accounts.
Straight Answers About FileVault Mac Encryption
Should I turn on FileVault disk encryption?
Yes. For any Mac with business data, FileVault should be on. It's free, built in, and protects the data if the Mac is lost or stolen.
Does FileVault slow down a Mac?
On Apple silicon and T2 Macs, the impact is negligible. Older Intel Macs may slow slightly during the first encryption, then return to normal.
Is FileVault on or off by default?
New Macs prompt you to turn on FileVault during setup, and many have it on after setup. Check in System Settings under Privacy & Security to be sure.
What happens if I lose my FileVault recovery key?
If you also forget your password, the data can't be recovered. That's why businesses should escrow recovery keys in an MDM.
How long does FileVault encryption take?
Usually minutes to a few hours, depending on the Mac and how much data it holds. You can keep working while it runs.
Is FileVault enough to protect a business Mac?
It protects data on a lost or stolen Mac. You still need strong passwords, MFA, updates, and endpoint protection for everything else.
Need Help Rolling Out FileVault on Your Macs? Give Us a Call
Want FileVault on every company Mac with the recovery keys where they belong? Give us a call at 410-703-3857 or send us a note. We manage Macs and PCs for businesses across Maryland, Virginia, and DC, including Bethesda, through our managed IT services at one flat monthly rate.
We can't stop anyone from leaving a MacBook at a coffee shop. We can make sure the MacBook is all they leave.
Comments