FileVault

FileVault is Apple's full-volume encryption for macOS. On Macs with Apple silicon or a T2 Security Chip, the internal storage is always encrypted in hardware, but without FileVault the volume key is not protected by any user secret. Turning on FileVault adds that protection: the volume key is wrapped with keys derived from the passwords of enabled users, so the data volume cannot be unlocked until one of those users authenticates.

FileVault also creates a recovery path. Organizations typically use a personal recovery key escrowed to their MDM, while individuals may choose iCloud-based recovery. Administrators manage it with the fdesetup command, which can report status, enable encryption, list enabled users and rotate recovery keys.

FileVault protects data at rest, which matters most when a Mac is lost, stolen or shut down during travel. It does not protect a running, unlocked Mac from malware or from someone with the user's password.

Read the FileVault guide for deployment and verification steps.