Data Encryption & Loss Prevention

Modern full-disk encryption assumes a hardware root of trust. A TPM 2.0 module holds the platform measurements and seals the volume key so the disk unlocks only on the machine it belongs to; Secure Boot and a current firmware baseline are what keep those measurements meaningful. That makes it a procurement issue as much as a licensing one — an estate of machines without a usable TPM cannot enforce the control the license describes, and the gap normally surfaces halfway through a rollout.

Above the disk sit the controls that touch data in motion: removable-media policy, port control, and encryption for files leaving the boundary. Key escrow and recovery is the operational detail buyers under-plan — somebody has to hold recovery keys, and where they are held determines whether a locked-out machine is a ten-minute fix or a rebuild.

Subscriptions are sourced through authorized US distribution rather than held on a shelf, so stock language does not apply to them; what matters is the term, the seat band and the co-termination date.

A DLP engine cannot tell you what is sensitive. It matches patterns and labels that your organization defined, applied to data your organization classified, under a policy your organization is prepared to enforce against its own staff. That last clause is where most deployments quietly fail — the rules go into monitor mode to avoid blocking work, and stay there.

Encryption has a narrower but sharper limit: it protects data at rest on a lost device. It does nothing about an authenticated user copying a file they are entitled to open. Both controls are worth buying; neither is worth over-claiming, and no purchase — hardware, license or service — confers a compliance outcome on its own.