id: os_external_apfs_hfs_volumes_encrypted
title: Ensure All APFS and HFS+ External User Storage Volumes Are Encrypted
discussion: |
  All APFS and HFS+ external user storage volumes _MUST_ be encrypted.

  While FileVault protects the boot volume, data may be copied to attached external storage and reduce the protection afforded by FileVault. All external user data volumes (APFS or HFS+) _MUST_ be encrypted to protect user data from loss or tampering. CoreStorage has been deprecated and replaced with APFS for volume encryption.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-96724-0
  cis:
    benchmark:
      macos_26:
        - 5.3.2 (level 1)
    controls_v8:
      - 3.6
      - 3.11
      - 13.6
      - 14.8
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
    enforcement_info:
      check:
        shell: |-
          fail=$(/usr/sbin/diskutil list external | /usr/bin/grep -E "APFS Volume|Apple_HFS|Logical Volume" | /usr/bin/awk '{print $NF}' | /usr/bin/xargs -n1 /usr/sbin/diskutil info 2>/dev/null | /usr/bin/awk '
            /Volume Name:/{name=$0; sub(/^[ \t]*Volume Name:[ \t]*/,"",name)}
            /FileVault:/{
              if ($2=="No") {
                if (list=="") list=name; else list=list ", " name
              }
            }
            END{print list}')
          if [ -z "$fail" ]; then
            /bin/echo "Yes"
          else
            /bin/echo "Unencrypted external volumes: $fail"
          fi
        result:
          string: 'Yes'
      fix:
        additional_info: |-
          Use Disk Utility to erase a user disk and format as APFS (Encrypted).

          NOTE: It is recommended using APFS over HFS+ where possible. If you do need to use an HFS+/CoreStorage external drive for compatibility reasons, you need to format the drive to MacOS Extended (Journaled) (or MacOS Extended (Case-Sensitive, Journaled) if Case-Sensitive is required).
tags:
  - cisv8
