BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

os_internal_apfs_volumes_encrypted Ensure All Internal User Storage APFS Volumes Are Encrypted

NIST macOS Security Compliance Project Tahoe Guidance, Revision 3.0 (cf656e8)
All changes in this version
first version loaded macOS

Title

Ensure All Internal User Storage APFS Volumes Are Encrypted

Control

fail=$(/usr/sbin/diskutil list internal | /usr/bin/grep "APFS Volume" | /usr/bin/awk '{print $NF}' | /usr/bin/xargs -n1 /usr/sbin/diskutil info 2>/dev/null | /usr/bin/awk '
/Volume Name:/{name=$0; sub(/^[ \t]*Volume Name:[ \t]*/,"",name)}
/FileVault:/{
if ($2=="No" && name !~ /^(Preboot|Recovery|VM)$/) {
if (list=="") list=name; else list=list ", " name
}
}
END{print list}')
if [ -z "$fail" ]; then
/bin/echo "Yes"
else
/bin/echo "Unencrypted internal user APFS volumes: $fail"
fi

Discussion

All internal user storage APFS volumes _MUST_ be encrypted.

While FileVault protects the boot volume, data may be copied to other attached internal storage and reduce the protection afforded by FileVault. All internal APFS volumes that carry user data and do not have a specific role (Preboot, Recovery, VM) _MUST_ be encrypted to protect user data from loss or tampering.

Fix

Use Disk Utility to erase a user disk and format as APFS (Encrypted).

NOTE: APFS Encrypted disks will be described as "FileVault" whether they are the boot volume or not.