A stolen laptop is an inconvenience. A stolen laptop full of plain-text client files is a risk that can result in a conversation with a regulator. Encryption keeps the former from turning into the latter.
If you’ve never encrypted data, be reassured that most of the tools you need are already on the devices you own. In this post, we’ll cover what data encryption is, how to encrypt your data with the tools you already have, and the best practices that keep encryption working a year from now.
What Is Data Encryption?
Data encryption scrambles readable information into a form that can’t be used without the right key.
The standard readable version of a file you’re probably familiar with is called plaintext. This goes for copy in Word documents, scanned invoices, and customer databases. The scrambled version is called ciphertext, which looks like random characters.
The right key turns ciphertext into plaintext. Without it, the ciphertext is noise. Using the correlating key reveals the original plaintext file.
The idea of a cypher predates computers by centuries, but the math is new. The strongest algorithms are published openly so anyone can attack them, which means security comes from protecting the key rather than hiding the method. That principle underpins how encryption protects information today.
The Advanced Encryption Standard (AES) does most of the work now. You’ll see it on vendor security sheets as AES-128, AES-192, or AES-256. Those numbers are key lengths in bits, and a longer key is harder to guess.
Federal Information Processing Standard (FIPS) 197 approves all three, and all three are still considered secure. AES-256 is what the National Security Agency requires for national security systems, which is why so many vendors advertise it.
Why Encryption Is Important
The encryption software usually isn’t the big expense. It already exists in the operating system in your phone and most of the platforms you pay for. The real cost is your attention: deciding what to cover, tracking keys, and confirming a year later that everything is still switched on.
That’s also what makes it worth the trouble. Most security controls depend on people behaving well, and human error can happen. Clean-desk policies erode, access reviews slip, and someone always finds a reason to email the spreadsheet. An encrypted drive behaves the same way on a bad day as it did on its first.
Be clear about the boundaries, though, because encryption gets sold as a cure-all and it isn’t one. It won’t keep an intruder off your network, stop an employee with valid credentials from copying a client list, or rescue a backup nobody tested.
Encryption answers a single question: if the wrong person ends up holding this file, can they read it? Federal rules, state statutes, and breach reporting thresholds are all built around that answer, which is why encryption has become a compliance requirement in several industries.
How to Encrypt Your Data
For most organizations, this starts as a settings audit, not a purchase. If you’re doing it for the first time, work in this order:
- Inventory what holds company information. Desktops, laptops, phones, tablets, external drives, backup media, and every cloud service you pay for. The list is usually longer than expected.
- Check what’s already on. Much of a modern fleet ships encrypted or one switch away from it, so part of the job may be done already.
- Switch on whole-drive encryption everywhere else, starting with anything that leaves the building.
- Decide where keys and recovery codes are kept, and write that down before you need them at 2 a.m.
Every current operating system includes whole-drive encryption, also called full-disk encryption, at no extra charge. On Windows Pro, Enterprise, and Education editions, that tool is BitLocker. Windows 11 version 24H2 dropped several hardware prerequisites, so far more machines now qualify for automatic device encryption out of the box.
Mac users get FileVault, which does the same job. On Apple silicon machines the keys stay inside a dedicated security chip called the Secure Enclave, never handed to the main processor. Phones need the least work: iPhones encrypt by default, and Android has required it on new devices since Android 10.
Ignore older guides pointing Windows users to the Encrypting File System checkbox in a file’s Properties menu. It still functions, but it’s legacy technology and was never meant to carry a business on its own. Whole-drive protection is the baseline, with file-level tools layered on top where a document needs separate handling.
Three more places need attention once computers are covered. Removable media, meaning the flash drive in a coat pocket or the external backup drive, should either encrypt itself or be formatted as an encrypted container, which Disk Utility on Mac and BitLocker To Go on Windows both create in a few clicks.
Files in motion need Transport Layer Security (TLS) for anything crossing the internet, plus a secure transfer service for anything too large to email. Hosted systems depend on what the vendor does, which is a question to settle before you sign, since cloud storage security varies more between providers than most buyers expect.
Financial statements, medical information, payroll and personnel records, contracts, and anything holding passwords repay the effort most, so work out which of your files actually need encryption before trying to protect everything equally.
Types of Data Encryption
Symmetric encryption uses one key to both lock and unlock. AES is the common example. It’s fast, so it handles bulk material such as full drives, database volumes, and backup archives. The catch is distribution: everyone who needs the file also needs the key, and the count climbs sharply. The National Institute of Standards and Technology (NIST) puts it at roughly 499,500 keys for 1,000 people all messaging each other privately.
Asymmetric encryption uses a matched pair instead — a public key anyone can hold, and a private key that never leaves its owner. Anything locked with one opens only with the other, so the public half can be handed out freely, and those same 1,000 people would need only 2,000 keys. The tradeoff is speed, since asymmetric algorithms run far slower.
Hybrid encryption is what your browser does on every secure page, and it’s a practical solution. The key pair handles the introduction and agrees on a shared secret, then symmetric encryption carries the traffic.
Protecting Data at Rest and in Transit
Data exists in three states, and encryption works differently in each.
- At rest covers anything stored, from hard drives and backup tapes to archives and the contents of a document management system. Whole-drive encryption is the tool for this state.
- In transit covers anything crossing a network. TLS is the standard mechanism, and current federal guidance calls for TLS 1.2 and 1.3, with older versions permitted only where documented compatibility needs justify them.
- In use covers data loaded into memory while an application works on it. It’s the least settled of the three, addressed by an emerging set of techniques called confidential computing. Most organizations get the full return from covering the first two well.
Turning encryption on is the easy half. The data encryption best practices below keep it doing its job, and they fit alongside the broader components of a data protection strategy.
Turn On Full-Disk Encryption First
Full-disk encryption offers substantial protection for relatively little effort because it addresses a common physical-loss scenario: hardware that leaves your control. A laptop in a taxi, a drive pulled from a decommissioned workstation, or a phone left at a conference may avoid becoming a disclosure if the encryption was properly configured, the device was powered down or locked, and the credentials and recovery keys were not compromised.
Apply it at setup as a policy, not a request to staff, and include the personal phones and laptops your team checks email on. Encryption that depends on users remembering to switch it on produces a fleet that is mostly encrypted, and “mostly” won’t help much if the wrong machine goes missing.
Keep Keys Separate From the Data
An encrypted archive stored alongside its own key is an unencrypted archive with extra steps. This is the most common way encryption fails, and it’s usually a decision of convenience. For instance, someone saves the recovery passphrase into the same folder so a restore in the middle of the night won’t stall. Federal guidance is direct on the point. Decryption tools belong on a separate device from the data they open.
Keys and recovery credentials belong in a dedicated key management system or a hardware security module, a purpose-built device that stores keys and never hands them back in readable form. Not in a shared folder, not in a spreadsheet, and not in the same backup set as the encrypted files. Limit access, log every retrieval, and if BitLocker recovery keys are saved to your directory service, confirm who can read them.
Give Every Key an Expiration Date
Keys shouldn’t live forever. The longer one stays in service, the more data it protects and the worse a single compromise becomes.
NIST’s key management guidance offers a usable default: a symmetric key used to encrypt new data shouldn’t stay in that role longer than two years, though the matching key has to remain available as long as you need to read the older files it locked. Keys used for digital signatures run shorter, at one to three years.
Write the rotation schedule down, tie it to a calendar instead of good intentions, and rehearse it. Rotating a key you can’t restore from is how organizations lose archives permanently.
Pair Encryption With Access Controls
Encryption establishes whether an unauthorized person can read your data. It says nothing about whether someone with valid credentials should have access at all.
Most breaches don’t break encryption. They log in through other means. Credential theft, phishing, and reused passwords hand an attacker a legitimate session, and files decrypt for them exactly as designed. Multifactor authentication, least-privilege permissions, and sensible password practices belong inside the encryption conversation from the start. Layered security across a records program holds up better than any single measure.
Encrypt Early So Disposal Is Clean
Encryption can make the end of the records lifecycle far simpler.
When a drive full of encrypted data reaches retirement, destroying the keys renders the contents unrecoverable without touching the media. NIST’s current media sanitization guidance accepts this cryptographic erase as a legitimate way to purge a drive, saving considerable time across a large hardware refresh.
One caveat. Cryptographic erase only counts if no sensitive data was ever written to that media in plaintext. Encrypt a drive after two years of unprotected use and the earlier material may still be recoverable. Day-one encryption means a clean disposal option later, which is why it belongs in the same conversation as secure data destruction practices.
Vet the Standards Your Providers Hold
Once records leave your building for a digitizing vendor, a storage facility, or a cloud platform, that provider’s encryption becomes your exposure. Ask questions instead of taking a security page at face value.
Start here: is the encryption running in a validated cryptographic module, and can you see the certificate?
A validated module is software or hardware independently tested against a federal standard, rather than a vendor’s assurance that the math is right. The federal program that runs those validations moves all FIPS 140-2 certificates to its historical list on September 22, 2026, so a vendor citing 140-2 for a new deployment is worth pressing. Then ask who holds the keys, how data is protected during pickup, transfer, and ingestion, and what the chain of custody looks like from your loading dock to their rack. Chain of custody documentation is the paperwork that proves the answer, and a provider who can’t produce it is telling you something.
Certifications shorten this conversation. PRISM Privacy+ is the credential built for information management and records storage, and it requires an independent audit through i-SIGMA. NAID AAA covers secure destruction and goes further, with unannounced audits as a condition of holding it. Either is a stronger signal than a marketing claim.
Regulated industries should push harder. Medical practices and financial firms are accountable for their vendors’ handling of protected data, not only their own, so know what the Health Insurance Portability and Accountability Act asks of you before a vendor tells you.
Start Preparing for Post-Quantum Now
Quantum computers, once they get powerful enough, will break the public-key math that protects key exchange today. Symmetric encryption like AES holds up comparatively well. Public-key algorithms don’t, and the replacement effort has already started.
NIST finalized its first three post-quantum standards in August 2024, ML-KEM, ML-DSA, and SLH-DSA, then added a backup called HQC in March 2025 in case the first choices are broken. Draft NIST guidance proposes phasing out today’s RSA and elliptic-curve algorithms after 2030 and disallowing them after 2035, though the document is still a draft and the dates could move.
Nothing needs ripping out this quarter. You do need to know where public-key cryptography lives in your environment, favor vendors with a published migration plan, and watch anything with a long confidentiality horizon. Records that must stay private for 20 years are being collected today by adversaries willing to wait, which puts long-retention archives first.
What Encryption Can’t Protect
Encryption is a digital control, and a great deal of what businesses are legally obligated to protect isn’t digital. The boxes in the storage closet, the personnel files behind reception, the archived case files in the basement. No encryption setting reaches any of them, and paper tends to be the largest gap in an otherwise careful security program.
Converting paper to digital files brings those records inside the same encryption, access control, and audit-trail regime as everything else, with the bonus that indexed archives are searchable in a way a banker’s box never was. Paperwork that has to stay in hard copy belongs in a secure offsite facility with controlled access and documented custody, and when retention periods run out, certified destruction closes the loop.
Digital archives you’ve stopped thinking about count too. Backup tapes and legacy microfilm outlive the systems that created them, and specialized media storage carries environmental and security requirements a server room doesn’t meet.
How Record Nations Helps Secure Your Records
Record Nations connects you with local digitizing and storage companies whose credentials, security controls, and industry background match what the job requires. Describe the project once, and the providers who respond have already worked through the encryption and chain-of-custody questions on jobs like yours.
We work closely with i-SIGMA so that providers in our network meet PRISM Privacy+ specifications for information management, NAID AAA standards for secure destruction, and ISO 9001 quality protocols. The same standards apply whether your files sit in Madison, WI, Minneapolis, MN, or in Canada.
Those providers can convert paper into encrypted, access-controlled systems, host records in a document management platform with permissions and audit trails built in, and move active files from off-site facilities to encrypted cloud storage where your retention rules travel with the documents.
To get started, fill out our form or call us at (866) 385-3706. We’ll help scope the project and find competitive quotes from providers who can meet your security requirements.
