2.6.1.1 Enable FileVault

Information

FileVault secures a system's data by automatically encrypting its boot volume and requiring a password or recovery key to access it.

Rationale:

Encrypting sensitive data minimizes the likelihood of unauthorized users gaining access to it.

Impact:

Mounting a FileVaulted volume from an alternate boot source will require a valid password to decrypt it.

Solution

Perform the following to implement the prescribed state:

Open System Preferences

Select Security & Privacy

Select FileVault

Select Turn on FileVault




Additional Information:

FileVault may not be desirable on a virtual OS. As long as the hypervisor and file storage are encrypted the virtual OS does not need to be. Rather than checking if the OS is virtual and passing the control regardless of the encryption of the host system the normal check will be run. Security officials can evaluate the comprehensive controls outside of the OS being tested.

See Also

https://workbench.cisecurity.org/files/3092

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-28(1), CSCv6|13.2

Plugin: Unix

Control ID: d4bd73797dd4a6536592faae16f34687fb3ff03803f21d41d6a3ad8c9ac3a97c