How to Encrypt Your Business Data in Transit and at Rest (Plain English)

Encrypting your business data requires enabling BitLocker on Windows devices and FileVault on Mac — both built into the operating system at zero cost. For 82% of small businesses, a stolen laptop means full access to client data because encryption was never turned on. BitLocker provides AES-256 encryption at rest, while TLS handles encryption in transit for email and web traffic, and both can be verified and enforced in under an hour.

If someone stole your office laptop right now — pulled it right off the desk and walked out — could they read your client data? What about your QuickBooks files, your customer database, your contracts folder? For 82% of small businesses, the answer is yes. They could pop the drive out, plug it into another machine, and browse everything like a thumb drive. That is what happens when your data is not encrypted at rest. And that is only half the problem — every email you send, every file you transfer, every login your team makes could be readable by anyone on the same network if your data is not encrypted in transit either.

Here is the good news: encrypting your business data is not the complicated, expensive project you think it is. The tools are built into your operating system and your browser already. You just need to turn them on — and then verify they are actually working. That is what this guide is about.

What Encryption Actually Means (No Jargon)

Let us strip away the technical language for a minute. Encryption is a lock. That is it. It takes your readable data and scrambles it so that only someone with the right key can unscramble it. Without the key, the data looks like random noise.

There are two situations where your data needs this protection:

Data at rest is data sitting on a hard drive, a USB stick, a server, or a cloud storage bucket. It is not moving — it is just stored. If someone gets physical access to that storage device, encryption prevents them from reading it. Think of it like a safe: even if someone breaks into your office and grabs the safe, they cannot open it without the combination.

Data in transit is data moving across a network — over the internet, over WiFi, between your computer and a server. If someone intercepts that traffic (which is easier than you think, especially on WiFi), encryption prevents them from reading it. Think of it like a sealed, opaque envelope: even if someone intercepts your mail, they cannot read the letter inside.

Most compliance frameworks — PCI DSS, HIPAA, SOC 2, FTC Safeguards — require both. Not one or the other. Both. And the penalties for getting caught without encryption after a data breach are significantly worse than the penalties for a breach where the data was encrypted, because encrypted stolen data is essentially useless to the attacker.

Data at Rest: BitLocker on Windows

Every copy of Windows 10 Pro, Windows 11 Pro, and Windows 11/12 Enterprise includes BitLocker — full-disk encryption that protects every file on your drive. It is free. It is built in. And Microsoft has spent over a decade hardening it. If you are running Windows Pro or Enterprise, there is no reason not to use it.

How BitLocker Works

BitLocker encrypts your entire drive using AES-256 (or AES-128, configurable). When you start your computer, the TPM chip on your motherboard (Trusted Platform Module — basically a hardware security chip soldered to your motherboard) verifies that no one has tampered with the boot process, then releases the encryption key so Windows can start. If someone removes the drive and puts it in another computer, the TPM is not there to release the key, so the data stays locked.

This means:

• Laptop stolen from a car? Encrypted. Thief gets nothing.
• Old hard drive thrown away without wiping? Encrypted. Dumpster diver gets nothing.
• Server decommissioned and sent to recycler? Encrypted. Data is unrecoverable.

Enabling BitLocker

Let us turn it on. Open PowerShell as Administrator:

# Check if your system supports BitLocker
Get-BitLockerVolume

# If you see output with VolumeStatus, BitLocker is available
# If you get an error, you are probably on Windows Home (need Pro)

If Get-BitLockerVolume returns information about your drives, you are good to go. If it throws an error, you are likely running Windows Home, which does not include BitLocker. The upgrade from Home to Pro is about $99 — worth every penny for full-disk encryption alone. Our guide to Security Monitoring for Small Businesses: What to Watch and How to Automate Alerts walks through this in more detail.

Now enable BitLocker on your system drive:

# Enable BitLocker on C: drive with TPM protection
Enable-BitLocker -MountPoint "C:" `
    -EncryptionMethod XtsAes256 `
    -TpmProtector

# Add a recovery password (SAVE THIS SOMEWHERE SAFE)
Add-BitLockerKeyProtector -MountPoint "C:" `
    -RecoveryPasswordProtector

# The command will output a Recovery Password like:
# 123456-789012-345678-901234-567890-123456-789012-345678
# WRITE THIS DOWN. Store it in your password manager or a safe.

Let me explain those flags. -EncryptionMethod XtsAes256 uses the strongest encryption method available — XTS-AES with a 256-bit key. Some older guides recommend AES-128, and while that is still secure, there is no performance reason not to use 256-bit on modern hardware. The -TpmProtector tells BitLocker to use your TPM chip, which means the drive unlocks automatically when the correct computer boots it — no PIN required for the system drive (though you can add one for extra security).

The recovery password is your emergency backup key. If your motherboard fails, if you need to move the drive to a new computer, if something goes wrong with TPM — this password lets you unlock the drive. Lose it, and you lose your data. Period. Store it in your password manager (Bitwarden, 1Password) and print a physical copy for your safe.

Encrypting Additional Drives

Do not forget data drives, external drives, and USB sticks:

# Encrypt a data drive (D:) with password protection
# Useful for external drives that move between computers
Enable-BitLocker -MountPoint "D:" `
    -EncryptionMethod XtsAes256 `
    -PasswordProtector

# You will be prompted for a password
# This password is required every time you plug in the drive

# For USB drives, use BitLocker To Go
# Same command works — just specify the USB drive letter
Enable-BitLocker -MountPoint "E:" `
    -EncryptionMethod XtsAes256 `
    -PasswordProtector

For external drives and USB sticks, you use a password instead of TPM (since the drive moves between computers). This means someone who finds your USB stick in a parking lot cannot read it — they need the password. Every USB drive that leaves your office should be encrypted. No exceptions.

Verifying BitLocker Status Across Your Fleet

Here is a PowerShell script that checks every computer in your Active Directory to verify BitLocker is actually enabled. This is the kind of evidence your auditor wants — proof that encryption is deployed everywhere, not just on the machines you remembered:

<#
.SYNOPSIS
    Audit BitLocker encryption status across all domain computers.
.DESCRIPTION
    Scans Active Directory for all computers and checks BitLocker
    status on each. Generates a compliance report showing which
    machines are encrypted and which need attention.
#>

# Requires: ActiveDirectory module, admin privileges
# Run from a domain-joined machine with RSAT installed

$Results = @()
$Computers = Get-ADComputer -Filter {Enabled -eq $true} `
    -Properties OperatingSystem, LastLogonDate |
    Where-Object { $_.LastLogonDate -gt (Get-Date).AddDays(-30) }

$TotalComputers = $Computers.Count
$Current = 0

foreach ($Computer in $Computers) {
    $Current++
    $ComputerName = $Computer.Name
    Write-Progress -Activity "Checking BitLocker Status" `
        -Status "$ComputerName ($Current of $TotalComputers)" `
        -PercentComplete (($Current / $TotalComputers) * 100)

    $Result = [PSCustomObject]@{
        ComputerName    = $ComputerName
        OperatingSystem = $Computer.OperatingSystem
        LastLogon       = $Computer.LastLogonDate
        BitLockerStatus = "Unknown"
        EncryptionMethod = "N/A"
        PercentEncrypted = "N/A"
        KeyProtector    = "N/A"
        RecoveryKeyInAD = $false
        Compliant       = $false
    }

    try {
        # Check if computer is reachable
        if (Test-Connection -ComputerName $ComputerName `
            -Count 1 -Quiet -TimeoutSeconds 3) {

            # Query BitLocker status remotely
            $BitLocker = Invoke-Command -ComputerName $ComputerName `
                -ScriptBlock {
                    Get-BitLockerVolume -MountPoint "C:" |
                    Select-Object VolumeStatus, EncryptionMethod,
                        EncryptionPercentage, KeyProtector
                } -ErrorAction Stop

            $Result.BitLockerStatus = $BitLocker.VolumeStatus.ToString()
            $Result.EncryptionMethod = $BitLocker.EncryptionMethod.ToString()
            $Result.PercentEncrypted = "$($BitLocker.EncryptionPercentage)%"

            # Check key protector types
            $Protectors = $BitLocker.KeyProtector |
                ForEach-Object { $_.KeyProtectorType.ToString() }
            $Result.KeyProtector = ($Protectors -join ", ")

            # Check if recovery key is stored in AD
            $ADRecoveryKey = Get-ADObject -Filter {
                objectClass -eq 'msFVE-RecoveryInformation'
            } -SearchBase $Computer.DistinguishedName `
              -ErrorAction SilentlyContinue

            $Result.RecoveryKeyInAD = ($null -ne $ADRecoveryKey)

            # Determine compliance
            $Result.Compliant = (
                $Result.BitLockerStatus -eq "FullyEncrypted" -and
                $Result.RecoveryKeyInAD -eq $true
            )
        }
        else {
            $Result.BitLockerStatus = "Offline"
        }
    }
    catch {
        $Result.BitLockerStatus = "Error: $($_.Exception.Message)"
    }

    $Results += $Result
}

# Generate report
$Timestamp = Get-Date -Format "yyyy-MM-dd_HHmmss"
$ReportPath = "BitLocker_Audit_$Timestamp.csv"
$Results | Export-Csv -Path $ReportPath -NoTypeInformation

# Summary
$Encrypted = ($Results | Where-Object { $_.BitLockerStatus -eq "FullyEncrypted" }).Count
$NotEncrypted = ($Results |
    Where-Object { $_.BitLockerStatus -notin @("FullyEncrypted", "Offline", "Unknown") -and
                   $_.BitLockerStatus -notlike "Error*" }).Count
$Offline = ($Results | Where-Object { $_.BitLockerStatus -eq "Offline" }).Count
$Compliant = ($Results | Where-Object { $_.Compliant -eq $true }).Count

Write-Host "`n========================================" -ForegroundColor Cyan
Write-Host "  BitLocker Encryption Audit Report" -ForegroundColor Cyan
Write-Host "========================================" -ForegroundColor Cyan
Write-Host "  Total computers scanned: $TotalComputers"
Write-Host "  Fully encrypted:         $Encrypted" -ForegroundColor Green
Write-Host "  Not encrypted:           $NotEncrypted" -ForegroundColor Red
Write-Host "  Offline/unreachable:      $Offline" -ForegroundColor Yellow
Write-Host "  Fully compliant (key+encryption): $Compliant" -ForegroundColor Green
Write-Host "  Report saved to: $ReportPath"
Write-Host "========================================`n" -ForegroundColor Cyan

# Flag non-compliant machines
$NonCompliant = $Results | Where-Object { $_.Compliant -eq $false -and
    $_.BitLockerStatus -ne "Offline" -and $_.BitLockerStatus -ne "Unknown" }

if ($NonCompliant) {
    Write-Host "`n  NON-COMPLIANT MACHINES:" -ForegroundColor Red
    $NonCompliant | ForEach-Object {
        Write-Host "    $($_.ComputerName): $($_.BitLockerStatus)" `
            -ForegroundColor Red
        if (-not $_.RecoveryKeyInAD) {
            Write-Host "      ↳ Recovery key NOT backed up to AD" `
                -ForegroundColor Yellow
        }
    }
}

This script does several critical things. First, it only checks computers that have logged on in the last 30 days — no point checking machines that have been off for six months. For each computer, it checks whether BitLocker is enabled, what encryption method is used, whether encryption is complete (not still encrypting), and whether the recovery key is backed up to Active Directory. That last part is crucial: if a laptop dies and the recovery key is not in AD, that data is gone forever.

The compliance flag requires both full encryption AND a recovery key backed up to AD. That is the standard most auditors expect.

macOS: FileVault

If your team uses Macs, the equivalent is FileVault. It uses AES-256 encryption (same strength as BitLocker) and integrates with the Mac’s T2 security chip or Apple Silicon’s Secure Enclave:

# Check FileVault status
sudo fdesetup status
# Output: FileVault is On/Off

# Enable FileVault
sudo fdesetup enable

# The command will display a recovery key — save it!
# You can also escrow keys to an MDM solution

# For fleet management, check all Macs via MDM
# Jamf, Mosyle, or Kandji can enforce and verify FileVault

Linux: LUKS

For Linux servers, LUKS (Linux Unified Key Setup) is the standard. Most distributions offer it during installation, but you can also encrypt partitions after the fact using cryptsetup.

Data in Transit: SSL/TLS Everywhere

Now let us tackle the other half. Every connection your business makes — email, web traffic, file transfers, remote desktop — should be encrypted in transit. The standard for this is TLS (Transport Layer Security), which you probably know as the padlock icon in your browser.

What You Need to Check

Here is a quick reality check for most small businesses:

Connection Type	Should Be Encrypted?	How?
Website (yours)	Yes	SSL/TLS certificate (HTTPS)
Email sending	Yes	TLS 1.2+ on SMTP
Email receiving	Yes	TLS 1.2+ on IMAP/POP3
Remote Desktop	Yes	RDP with NLA + TLS
VPN connections	Yes	IPsec or WireGuard
File transfers	Yes	SFTP (not FTP)
Database connections	Yes	TLS encrypted connections
WiFi	Yes	WPA3 (or WPA2 minimum)
Internal web apps	Yes	Internal CA or self-signed certs
API integrations	Yes	HTTPS endpoints only

If you are using plain FTP, plain HTTP for internal tools, or RDP without TLS — you have data flying across your network that anyone with Wireshark can read. That includes passwords, customer data, financial records, and everything else.

Your Website: SSL/TLS Certificate Check

Let us start with the most visible one — your business website. Here is a PowerShell script that checks your website’s SSL/TLS certificate and tells you exactly what is going on:

<#
.SYNOPSIS
    Check SSL/TLS certificate status and security configuration
    for one or more websites.
.DESCRIPTION
    Validates certificate expiration, issuer, protocol support,
    and common misconfigurations. Outputs a compliance-ready report.
#>

param(
    [string[]]$Websites = @(
        "yourbusiness.com",
        "mail.yourbusiness.com",
        "portal.yourbusiness.com"
    ),
    [int]$ExpirationWarningDays = 30
)

$Results = @()

foreach ($Site in $Websites) {
    Write-Host "`nChecking: $Site" -ForegroundColor Cyan

    $Result = [PSCustomObject]@{
        Website          = $Site
        Status           = "Unknown"
        Issuer           = "N/A"
        Subject          = "N/A"
        ValidFrom        = "N/A"
        ValidTo          = "N/A"
        DaysUntilExpiry  = 0
        Protocol         = "N/A"
        KeySize          = "N/A"
        SignatureAlg     = "N/A"
        SANs             = "N/A"
        TLS12Supported   = $false
        TLS13Supported   = $false
        TLS10Supported   = $false  # Should be false
        Compliant        = $false
        Issues           = @()
    }

    try {
        # Create TCP connection and get certificate
        $TcpClient = New-Object System.Net.Sockets.TcpClient
        $TcpClient.Connect($Site, 443)

        $SslStream = New-Object System.Net.Security.SslStream(
            $TcpClient.GetStream(),
            $false,
            { param($s, $cert, $chain, $errors) return $true }
        )

        # Try TLS 1.3 first, fall back to TLS 1.2
        try {
            $SslStream.AuthenticateAsClient($Site, $null,
                [System.Security.Authentication.SslProtocols]::Tls13,
                $false)
            $Result.TLS13Supported = $true
        }
        catch {
            $SslStream = New-Object System.Net.Security.SslStream(
                $TcpClient.GetStream(),
                $false,
                { param($s, $cert, $chain, $errors) return $true }
            )
            $SslStream.AuthenticateAsClient($Site, $null,
                [System.Security.Authentication.SslProtocols]::Tls12,
                $false)
        }

        $Cert = $SslStream.RemoteCertificate
        $Cert2 = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($Cert)

        # Extract certificate details
        $Result.Issuer = $Cert2.Issuer
        $Result.Subject = $Cert2.Subject
        $Result.ValidFrom = $Cert2.NotBefore.ToString("yyyy-MM-dd")
        $Result.ValidTo = $Cert2.NotAfter.ToString("yyyy-MM-dd")
        $Result.DaysUntilExpiry = ($Cert2.NotAfter - (Get-Date)).Days
        $Result.Protocol = $SslStream.SslProtocol.ToString()
        $Result.KeySize = "$($Cert2.PublicKey.Key.KeySize)-bit"
        $Result.SignatureAlg = $Cert2.SignatureAlgorithm.FriendlyName

        # Check SANs (Subject Alternative Names)
        $SanExtension = $Cert2.Extensions |
            Where-Object { $_.Oid.FriendlyName -eq "Subject Alternative Name" }
        if ($SanExtension) {
            $Result.SANs = $SanExtension.Format($true)
        }

        # Check TLS 1.2 support
        try {
            $TcpTest12 = New-Object System.Net.Sockets.TcpClient
            $TcpTest12.Connect($Site, 443)
            $SslTest12 = New-Object System.Net.Security.SslStream(
                $TcpTest12.GetStream(), $false,
                { param($s, $c, $ch, $e) return $true })
            $SslTest12.AuthenticateAsClient($Site, $null,
                [System.Security.Authentication.SslProtocols]::Tls12, $false)
            $Result.TLS12Supported = $true
            $SslTest12.Close()
            $TcpTest12.Close()
        } catch { }

        # Check for dangerous TLS 1.0 support
        try {
            $TcpTest10 = New-Object System.Net.Sockets.TcpClient
            $TcpTest10.Connect($Site, 443)
            $SslTest10 = New-Object System.Net.Security.SslStream(
                $TcpTest10.GetStream(), $false,
                { param($s, $c, $ch, $e) return $true })
            $SslTest10.AuthenticateAsClient($Site, $null,
                [System.Security.Authentication.SslProtocols]::Tls,
                $false)
            $Result.TLS10Supported = $true
            $SslTest10.Close()
            $TcpTest10.Close()
        } catch { }

        # Evaluate compliance
        $Issues = @()

        if ($Result.DaysUntilExpiry -lt 0) {
            $Issues += "CRITICAL: Certificate EXPIRED"
            $Result.Status = "EXPIRED"
        }
        elseif ($Result.DaysUntilExpiry -lt $ExpirationWarningDays) {
            $Issues += "WARNING: Certificate expires in $($Result.DaysUntilExpiry) days"
            $Result.Status = "EXPIRING SOON"
        }
        else {
            $Result.Status = "Valid"
        }

        if ($Result.TLS10Supported) {
            $Issues += "TLS 1.0 is enabled (insecure, should be disabled)"
        }

        if (-not $Result.TLS12Supported -and -not $Result.TLS13Supported) {
            $Issues += "Neither TLS 1.2 nor TLS 1.3 supported"
        }

        if ($Cert2.PublicKey.Key.KeySize -lt 2048) {
            $Issues += "Key size below 2048-bit minimum"
        }

        if ($Result.SignatureAlg -match "SHA1") {
            $Issues += "Uses SHA-1 signature (deprecated)"
        }

        $Result.Issues = $Issues
        $Result.Compliant = ($Issues.Count -eq 0 -and
                            $Result.Status -eq "Valid")

        $SslStream.Close()
        $TcpClient.Close()
    }
    catch {
        $Result.Status = "CONNECTION FAILED"
        $Result.Issues = @("Could not establish SSL connection: $($_.Exception.Message)")
    }

    # Display results
    $StatusColor = switch ($Result.Status) {
        "Valid"         { "Green" }
        "EXPIRING SOON" { "Yellow" }
        "EXPIRED"       { "Red" }
        default         { "Red" }
    }

    Write-Host "  Status: $($Result.Status)" -ForegroundColor $StatusColor
    Write-Host "  Issuer: $($Result.Issuer)"
    Write-Host "  Expires: $($Result.ValidTo) ($($Result.DaysUntilExpiry) days)"
    Write-Host "  Protocol: $($Result.Protocol)"
    Write-Host "  Key: $($Result.KeySize)"
    Write-Host "  TLS 1.3: $($Result.TLS13Supported) | TLS 1.2: $($Result.TLS12Supported)"

    if ($Result.TLS10Supported) {
        Write-Host "  TLS 1.0: ENABLED (INSECURE)" -ForegroundColor Red
    }

    if ($Result.Issues.Count -gt 0) {
        Write-Host "  Issues:" -ForegroundColor Yellow
        $Result.Issues | ForEach-Object {
            Write-Host "    - $_" -ForegroundColor Yellow
        }
    }

    $Results += $Result
}

# Export report
$Timestamp = Get-Date -Format "yyyy-MM-dd_HHmmss"
$ReportPath = "SSL_TLS_Audit_$Timestamp.csv"

$Results | Select-Object Website, Status, Issuer, ValidTo,
    DaysUntilExpiry, Protocol, KeySize, TLS12Supported,
    TLS13Supported, TLS10Supported, Compliant,
    @{N='Issues';E={$_.Issues -join '; '}} |
    Export-Csv -Path $ReportPath -NoTypeInformation

Write-Host "`n======================================" -ForegroundColor Cyan
Write-Host "  SSL/TLS Audit Summary" -ForegroundColor Cyan
Write-Host "======================================" -ForegroundColor Cyan
$Valid = ($Results | Where-Object { $_.Status -eq "Valid" }).Count
$Expiring = ($Results | Where-Object { $_.Status -eq "EXPIRING SOON" }).Count
$Failed = ($Results | Where-Object { $_.Status -notin @("Valid","EXPIRING SOON") }).Count
Write-Host "  Valid:    $Valid" -ForegroundColor Green
Write-Host "  Expiring: $Expiring" -ForegroundColor Yellow
Write-Host "  Failed:   $Failed" -ForegroundColor Red
Write-Host "  Report:   $ReportPath"
Write-Host "======================================`n" -ForegroundColor Cyan

This script checks several things that matter for compliance. It verifies the certificate is not expired or about to expire (the default warning is 30 days). It tests for TLS 1.3 and TLS 1.2 support — both are considered secure. It checks whether TLS 1.0 is still enabled, which is a compliance failure for PCI DSS 4.0 and a red flag for every other framework. It verifies key size is at least 2048-bit and that the signature algorithm is not using deprecated SHA-1.

The important thing to understand: having a certificate installed does not mean you are secure. You could have a valid certificate but still support TLS 1.0, which has known vulnerabilities. You could have strong TLS but a 1024-bit key that can be cracked. This script catches all of those issues.

Disabling Insecure TLS Versions

If the script finds TLS 1.0 or 1.1 enabled on your Windows server, here is how to disable them:

# Disable TLS 1.0
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -Force
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" `
    -Name "Enabled" -Value 0 -PropertyType DWORD -Force
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" `
    -Name "DisabledByDefault" -Value 1 -PropertyType DWORD -Force

# Disable TLS 1.1
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" -Force
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" `
    -Name "Enabled" -Value 0 -PropertyType DWORD -Force
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" `
    -Name "DisabledByDefault" -Value 1 -PropertyType DWORD -Force

# Ensure TLS 1.2 is explicitly enabled
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" -Force
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" `
    -Name "Enabled" -Value 1 -PropertyType DWORD -Force
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server" `
    -Name "DisabledByDefault" -Value 0 -PropertyType DWORD -Force

# Requires a server reboot to take effect
Write-Host "`nTLS 1.0 and 1.1 disabled. TLS 1.2 enabled." -ForegroundColor Green
Write-Host "A server REBOOT is required for changes to take effect." -ForegroundColor Yellow

Before you run this, check whether any legacy applications require TLS 1.0 — some older line-of-business apps, printers, and scanners might stop working. Test in your environment first. That said, PCI DSS 4.0 explicitly requires TLS 1.2 as a minimum, and cyber insurance policies are increasingly following suit. If your app needs TLS 1.0, that app needs to be upgraded or replaced.

Email Encryption: Checking Your Configuration

Email is one of the most common places businesses send sensitive data unencrypted. If your email server is not enforcing TLS, your messages are flying across the internet in plain text. Here is how to check:

Microsoft 365: Your email is encrypted in transit by default using TLS 1.2. You can verify this in the Exchange admin center under Mail Flow → Connectors. Microsoft calls this “opportunistic TLS” — it tries TLS first and falls back to unencrypted if the receiving server does not support it. For sensitive industries, you can enforce TLS so that emails only send if the connection is encrypted:

# Connect to Exchange Online
Connect-ExchangeOnline

# Check current connector settings
Get-TransportRule | Where-Object { $_.Name -like "*TLS*" } |
    Select-Object Name, State, Priority

# Create a rule requiring TLS for sensitive domains
New-TransportRule -Name "Require TLS to Partners" `
    -RecipientDomainIs @("partner.com", "bank.com", "healthcare.org") `
    -RouteMessageOutboundRequireTls $true `
    -RejectMessageEnhancedStatusCode "5.7.1" `
    -RejectMessageReasonText "TLS encryption required for this recipient domain"

Google Workspace: Similar setup. Go to Admin Console → Apps → Google Workspace → Gmail → Compliance → Secure transport (TLS) compliance. You can require TLS for specific domains or all outbound mail.

WiFi Encryption

Your office WiFi is another place data flies around unencrypted if you are not careful. WPA3 is the current standard. WPA2 is acceptable but aging. WEP or open WiFi is catastrophically insecure — anyone in your parking lot can read your traffic.

Check your current WiFi security:

# Show current WiFi connection security details
netsh wlan show interfaces | Select-String "Authentication|Cipher|Signal"

# Expected output for a secure connection:
#     Authentication     : WPA2-Enterprise or WPA3-Personal
#     Cipher             : CCMP or GCMP
#     Signal             : 80%+

# List all saved WiFi profiles and their security
netsh wlan show profiles | ForEach-Object {
    if ($_ -match "All User Profile\s*:\s*(.+)") {
        $ProfileName = $Matches[1].Trim()
        $Details = netsh wlan show profile name="$ProfileName" key=clear
        $Auth = ($Details | Select-String "Authentication").ToString().Split(":")[-1].Trim()
        $Cipher = ($Details | Select-String "Cipher" | Select-Object -First 1).ToString().Split(":")[-1].Trim()

        [PSCustomObject]@{
            Profile = $ProfileName
            Authentication = $Auth
            Cipher = $Cipher
            Secure = ($Auth -match "WPA2|WPA3")
        }
    }
}

If you see “Open” or “WEP” for any profile your team connects to — especially at client sites or coffee shops — that connection is not encrypted. This is why you need a VPN for any work done on untrusted networks.

The Encryption Compliance Checklist

Here is a consolidated checklist you can print out, work through, and hand to your auditor:

Data at Rest

• [ ] All laptops have BitLocker (Windows) or FileVault (Mac) enabled
• [ ] Recovery keys are backed up to AD or MDM (not written on sticky notes)
• [ ] USB drives used for business data are encrypted (BitLocker To Go)
• [ ] Server drives are encrypted
• [ ] Database files are encrypted (SQL Server TDE, MongoDB encrypted storage engine)
• [ ] Cloud storage uses server-side encryption (S3 SSE, Azure Storage encryption)
• [ ] Backup files are encrypted
• [ ] Decommissioned drives are either encrypted or physically destroyed

Data in Transit

• [ ] Website uses HTTPS with valid certificate (TLS 1.2 minimum)
• [ ] TLS 1.0 and 1.1 disabled on all servers
• [ ] Email enforces TLS for outbound delivery
• [ ] Remote access uses VPN or encrypted connection (no plain RDP over internet)
• [ ] File transfers use SFTP, not FTP
• [ ] WiFi uses WPA2-Enterprise or WPA3
• [ ] Internal web applications use HTTPS (even on the LAN)
• [ ] API integrations use HTTPS endpoints

Key Management

• [ ] Encryption keys are stored securely (not in the same place as encrypted data)
• [ ] Recovery keys are accessible by at least two authorized people
• [ ] Key rotation policy exists (even if it is annual)
• [ ] Key escrow or backup procedures are documented

Verification

• [ ] BitLocker audit script runs monthly
• [ ] SSL/TLS scan runs weekly
• [ ] Reports are archived for compliance evidence
• [ ] Non-compliant machines are remediated within 30 days

The Business Case for Encryption

Still not convinced? Here are the numbers that matter for DeLand businesses:

Cyber insurance: Over 78% of cyber insurers now require encryption standards (TLS 1.3, AES-256) to qualify for coverage. If your data is not encrypted, your premiums go up — or you get denied entirely.

Breach notification: Under Florida’s Information Protection Act, if stolen data was encrypted with an industry-standard method, you may not be required to notify affected individuals. Unencrypted stolen data triggers mandatory notification — plus the PR disaster, legal costs, and lost customers that come with it.

Compliance: PCI DSS 4.0 Requirement 3.5 (data at rest) and 4.2 (data in transit) explicitly require encryption. HIPAA requires encryption of ePHI both at rest and in transit. The FTC Safeguards Rule requires encryption for customer financial information. None of these are optional.

Cost: BitLocker is free. FileVault is free. Let’s Encrypt SSL certificates are free. The PowerShell scripts in this article are free. The only cost is the time to enable them — maybe a Saturday afternoon for a small office. Compare that to the average small business breach cost of $108,000 (2025 Hiscox data), and the math is not even close.

Common Mistakes to Avoid

Encrypting the drive but not backing up the recovery key. This is the number one mistake. Your laptop gets BitLocker-encrypted, the motherboard fails, and no one knows the recovery key. That data is gone — permanently. Always back up recovery keys to Active Directory, your MDM, or at minimum your password manager.

Assuming your hosting provider handles SSL. Maybe they do, maybe they do not. Run the SSL check script against your actual domain. We have seen businesses with expired certificates, TLS 1.0 still enabled, and even plain HTTP serving customer login pages. Trust but verify.

Encrypting laptops but not USB drives. A single unencrypted USB stick with an employee’s client list is a breach waiting to happen. Enforce BitLocker To Go on all removable media, or better yet, disable USB storage via Group Policy and use approved cloud sharing instead.

Using encryption as your only security measure. Encryption protects data from unauthorized access — but if an attacker compromises a legitimate user’s account, that user’s access works just fine whether the data is encrypted or not. Encryption is one layer. You still need MFA, access controls, monitoring, and everything else.

The Bottom Line

The right technology setup saves time, reduces costs, and lets you focus on running your business instead of troubleshooting IT problems. Start with the fundamentals, implement them properly, and build from there.

FAQ

Is BitLocker good enough for compliance, or do I need something more expensive?

BitLocker with AES-256 encryption meets the requirements of PCI DSS, HIPAA, SOC 2, and the FTC Safeguards Rule. It is the same encryption standard used by government agencies. Third-party encryption tools like Symantec Endpoint Encryption or McAfee Drive Encryption offer additional management features (like centralized reporting), but the encryption itself is not stronger. For most small businesses, BitLocker with recovery keys backed up to Active Directory is sufficient for compliance.

What happens if an employee forgets their BitLocker password for an external drive?

If the recovery key was backed up (to AD, your password manager, or a printed copy in your safe), you can unlock the drive with the recovery key. If the recovery key was not backed up, that data is unrecoverable. This is by design — if there were a backdoor, encryption would be pointless. This is why recovery key management is the most critical part of your encryption strategy, not the encryption itself.

Does encrypting data slow down my computer?

On modern hardware with a TPM chip (any computer made after 2016), BitLocker has negligible performance impact — typically less than 2% on SSDs. You will not notice it in daily use. The initial encryption process takes a few hours for a full drive, but it runs in the background and you can work normally during it. On older hardware or HDDs, the impact is slightly higher but still minimal.

Should I encrypt my cloud data too, or is that the cloud provider’s job?

Both. Major cloud providers (Microsoft 365, Google Workspace, AWS, Azure) encrypt your data at rest by default using their own keys. But for sensitive data, you should consider using your own encryption keys (BYOK/CMK — Bring Your Own Key / Customer Managed Key) so that even the cloud provider cannot access your data. For most small businesses, the provider’s default encryption satisfies compliance requirements, but healthcare and financial services may need BYOK for regulatory reasons.

We use Macs — is FileVault equivalent to BitLocker for compliance?

Yes. FileVault uses AES-256-XTS encryption, which is the same algorithm and key strength as BitLocker’s strongest mode. For compliance purposes, auditors treat them identically. The main difference is management: BitLocker integrates with Active Directory and Group Policy, while FileVault integrates with Apple Business Manager and MDM solutions like Jamf or Mosyle. Make sure recovery keys are escrowed to your MDM — that is the equivalent of backing up BitLocker keys to AD.

How do I encrypt database connections?

Most modern databases support TLS-encrypted connections. For SQL Server, enable “Force Encryption” in SQL Server Configuration Manager. For PostgreSQL, set ssl = on in postgresql.conf. For MySQL, add require_secure_transport = ON to your configuration. The key is testing after enabling — use SELECT * FROM sys.dm_exec_connections WHERE encrypt_option = 'TRUE' on SQL Server to verify connections are actually encrypted, not just configured.