Full-disk encryption
Full-disk encryption scrambles everything stored on a laptop, desktop or phone so the data cannot be read without unlocking the device first. Cyber Essentials v3.3 does not require it and no Danzell question asks about it. The related requirement is device unlocking: a password, PIN or biometric before anyone can use the device, protected against guessing (A5.10).
- Term
- Full-disk encryption
- Also known as
- FDE, Device encryption, BitLocker, FileVault
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term full-disk encryption mean in Cyber Essentials?
Full-disk encryption scrambles everything stored on a laptop, desktop or phone so the data cannot be read without unlocking the device first.
How does full-disk encryption apply to Cyber Essentials?
In plain terms
Picture a safe that holds the entire contents of your laptop. When the laptop is off or locked, everything on it is sealed, and only the right password, PIN or fingerprint opens it. If the laptop is left on a train, whoever finds it has a piece of hardware and nothing else. BitLocker on Windows, FileVault on macOS and the built-in encryption on modern iPhones and Android phones are common examples.
What Cyber Essentials asks
Nothing about encryption. The closest requirement is device unlocking, in the secure configuration control: "If a device requires a user’s physical presence to access a device’s services (such as logging on to a laptop or unlocking a mobile phone), a credential such as a biometric, password or PIN must be in place before a user can gain access to the services."
That credential must be protected against brute-force guessing, by throttling to "no more than 10 guesses in 5 minutes" or by locking the device after "no more than 10 unsuccessful attempts". A password or PIN used only to unlock a device must be at least 6 characters. A5.10 asks which unlocking method you use.
The two work together. Encryption only protects the data if the unlock credential is strong, and the scheme is what makes that credential strong.
Worth knowing
Customers, insurers and data protection obligations may expect device encryption even though Cyber Essentials does not assess it. On managed devices it is usually a single policy in your device management tool.
See the secure configuration requirements and A5.10. Related: encryption, device unlocking.
Related terms
- EncryptionEncryption is scrambling information with a secret key so that only someone holding the right key can read it.
- Device unlockingDevice unlocking is the check, such as a PIN, password, fingerprint or face scan, that a person must pass before they can use a laptop, phone or tablet.
- IaaS (Infrastructure as a Service)Infrastructure as a Service (IaaS) is renting virtual servers and networks from a cloud provider, which your organisation then sets up and looks after much as it would physical equipment.
- MalwareMalware is software that someone has written and spread on purpose to cause harm, such as computer viruses, worms and ransomware.
- Managed service provider (MSP)A managed service provider (MSP) is an outside company you pay to run or support your IT.
- PaaS (Platform as a Service)Platform as a Service (PaaS) is a cloud service where the provider runs the servers underneath and your organisation supplies and manages its own applications.
Frequently asked questions
Full-disk encryption scrambles everything stored on a laptop, desktop or phone so the data cannot be read without unlocking the device first.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.