---
id: os_internal_apfs_volumes_encrypted
title: Ensure All Internal User Storage APFS Volumes Are Encrypted
discussion: |
  All internal user storage APFS volumes _MUST_ be encrypted.

  While FileVault protects the boot volume, data may be copied to other attached internal storage and reduce the protection afforded by FileVault. All internal APFS volumes that carry user data and do not have a specific role (Preboot, Recovery, VM) _MUST_ be encrypted to protect user data from loss or tampering.
references:
  nist:
    cce:
      macos_26:
        - CCE-96725-7
  cis:
    benchmark:
      macos_26:
        - 5.3.1 (level 1)
    controls_v8:
      - 3.6
      - 3.11
      - 13.6
      - 14.8
platforms:
  macOS:
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
    enforcement_info:
      check:
        shell: |-
          fail=$(/usr/sbin/diskutil list internal | /usr/bin/grep "APFS Volume" | /usr/bin/awk '{print $NF}' | /usr/bin/xargs -n1 /usr/sbin/diskutil info 2>/dev/null | /usr/bin/awk '
            /Volume Name:/{name=$0; sub(/^[ \t]*Volume Name:[ \t]*/,"",name)}
            /FileVault:/{
              if ($2=="No" && name !~ /^(Preboot|Recovery|VM)$/) {
                if (list=="") list=name; else list=list ", " name
              }
            }
            END{print list}')
          if [ -z "$fail" ]; then
            /bin/echo "Yes"
          else
            /bin/echo "Unencrypted internal user APFS volumes: $fail"
          fi
        result:
          string: 'Yes'
      fix:
        additional_info: |-
          Use Disk Utility to erase a user disk and format as APFS (Encrypted).

          NOTE: APFS Encrypted disks will be described as "FileVault" whether they are the boot volume or not.
tags:
  - cisv8
