--- title: "Is data encrypted at rest on endpoints (laptops, desktops, portable devices)?" url: https://insuranceposture.com/questions/endpoint-and-patching/data-encrypted-at-rest-endpoints category: "Endpoint protection and patching" canonical_key: q_edr_007 evidence_state: partial updated: 2026-08-24 --- # Is data encrypted at rest on endpoints (laptops, desktops, portable devices)? URL: https://insuranceposture.com/questions/endpoint-and-patching/data-encrypted-at-rest-endpoints Section: Endpoint protection and patching Evidence state: Partly verifiable from your tenant This is one of the few controls that changes whether an incident is a notifiable breach at all, which is why carriers care about it out of proportion to its cost. ## What the carrier is actually asking The carrier is asking whether the storage in laptops, desktops, and portable devices is encrypted, so that a lost or stolen device does not become a data breach. It usually means full-disk encryption with keys escrowed centrally rather than a user-managed passphrase. ## Why it is underwritten In many jurisdictions, loss of an encrypted device with keys intact is not a reportable breach, while loss of an unencrypted one is. That single distinction is the difference between an inconvenience and a notification exercise with regulatory exposure and credit monitoring costs. The carrier pays for the second outcome. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Encryption state on managed endpoints is measurable through device management, and key escrow is visible in the directory. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Microsoft 365 | Intune disk encryption policy and per-device encryption state | Encryption enforced by policy and confirmed present per device, not merely enabled in a baseline | | Entra ID | BitLocker recovery key escrow to the directory | Keys escrowed, and recovery key read access restricted so that escrow does not become an exposure of its own | | Microsoft 365 | Compliance policy requiring encryption, tied to Conditional Access | An unencrypted device fails compliance and loses access, which is the enforcement half | | Azure | Disk encryption on virtual machines and unattached disks | The server-side equivalent, including disks left behind after decommissioning | | Endpoint fleet | macOS FileVault and Linux volume encryption state | Non-Windows devices covered by an equivalent policy rather than assumed | **Escrow access is its own control** Recovery keys stored in the directory can be read by more roles than most organisations expect. Restricting who can retrieve them matters, because an attacker with directory access and recovery key visibility can unlock the devices they physically obtain later. ## What a defensible yes requires - Encryption is enforced by policy and verified per device rather than assumed from the image. - Recovery keys are escrowed centrally, with read access restricted to a small role. - Non-Windows endpoints are covered by equivalent policy. - Removable media is addressed, whether by encryption or by blocking it entirely. - Compliance enforcement means an unencrypted device cannot reach corporate data. ## How this answer goes wrong Encryption is in the standard image, so the answer is yes, and the estate contains devices built before the standard changed, devices rebuilt manually, and devices from an acquisition. Nobody has checked per-device state. The second failure is escrow: encryption on and keys held only by the user, which protects the data and prevents the organisation from recovering it. ## If this answer turns out to be wrong Agent coverage, patch state, and end-of-life software are the answers that move fastest without anyone deciding to move them, so this block is where an accurate answer most often ages into an inaccurate one before the policy expires. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [why an accurate answer ages, and when the policy makes that matter](https://insuranceposture.com/glossary/point-in-time-underwriting). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Does this apply to phones? Modern mobile platforms encrypt by default when a passcode is set, so the practical control is requiring a passcode and enforcing it through device or application policy. ### What about removable media? Carriers ask about portable devices deliberately. Either encrypt removable media by policy or block it, and say which you chose. ### Does encryption help against ransomware? No. It protects against loss and theft of the device. It is worth being clear on that, because conflating the two weakens both answers. ### How do we prove it per device? Export the encryption state report from device management. It shows state rather than policy, which is exactly the distinction an adjuster will draw. ## Related questions - [Is sensitive data encrypted in transit?](https://insuranceposture.com/questions/data-handling/sensitive-data-encrypted-transit) - [Are users able to store data to the hard drive of portable computers or portable media devices?](https://insuranceposture.com/questions/data-handling/users-able-store-data-hard-drive-portable-computers-portable) - [Are users able to access email through a non-corporate (BYOD/personal) device?](https://insuranceposture.com/questions/access-control/users-able-access-email-through-non-corporate-device) - [Are backups encrypted?](https://insuranceposture.com/questions/backup-and-recovery/backups-encrypted) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.