Date: 10/30/2025
Purpose: The purpose of whole disk encryption (WDE) is to ensure that all data at rest—including operating system files, application data, temporary files, and unallocated space—is encrypted and inaccessible without proper authentication.
1. Recommendation
Whole disk encryption (WDE) is recommended on all devices, where feasible, in order to reduce the risk of data exposure resulting from device loss, theft, or unauthorized physical access, and is required for servers located outside an ITS or HIT managed data center or a physically secure departmental machine room and individual use devices with highly sensitive data.
Using WDE to secure data:
- Encrypts the entire storage device.
- Prevents access to data unless the device is properly authenticated.
2. Approved Encryption Tools
Use these approved platform-specific, built-in encryption tools:
- Windows: BitLocker
- macOS: FileVault
- Linux: LUKS (via dm-crypt)
- Health Information and Technology (HIT) users should use encryption methods the HIT Security Office recommends.
- Contact [email protected] with any questions.
3. Best Practices
- Always encrypt drives before storing highly sensitive and sensitive data.
- Use FIPS validated cryptographic modules when feasible.
- Use strong, industry-standard cryptographic algorithms, like AES-128 or AES-256, which are compliant with most standards (e.g., NIST, HIPAA, GDPR).
- Use an encryption mode that is designed for disk encryption such as AES-XTS.
- Enable integrity checks to detect tampering (e.g., using HMAC or authenticated encryption modes like AES-GCM).
- Rotate keys periodically and have a key management policy.
- Consult the How to Implement Whole-Disk Encryption page for instructions on implementing whole-disk encryption on individual devices.
4. Review
- Regularly audit encryption practices and key management systems.
- Update encryption tools and algorithms as new standards emerge.
5. Further Guidance
Last Reviewed: 10/30/25