Comprehensive Rules for planning, deploying, managing, and auditing FileVault-based full-disk encryption on macOS devices in personal and MDM-managed environments.
Stop manually managing disk encryption across your Mac fleet. These Cursor Rules deliver industrial-strength FileVault automation that eliminates security gaps while reducing administrative overhead by 80%.
Your organization probably falls into one of these scenarios:
The Manual Nightmare: IT manually enables FileVault on each device, recovery keys get lost in spreadsheets, and compliance audits become week-long scrambles to verify encryption status across hundreds of endpoints.
The Partial Coverage Problem: Some devices have encryption, others don't. External drives remain unencrypted. Recovery keys exist somewhere, but good luck finding them when you need device recovery at 2 AM.
The MDM Misconfiguration: Your MDM pushes encryption policies, but edge cases slip through. macOS updates reset recovery keys without re-escrow. Performance issues get blamed on FileVault instead of being properly diagnosed.
Each of these scenarios creates the same outcome: your data protection strategy has systematic holes that compliance frameworks and threat actors will exploit.
These Cursor Rules implement enterprise-class disk encryption management that treats FileVault as critical infrastructure, not an optional security feature. You get comprehensive automation for the complete encryption lifecycle—from initial deployment through key rotation and compliance reporting.
The rules enforce a defense-in-depth approach where disk encryption becomes your reliable last line of defense, integrated with secure boot, MDM policies, and automated key management.
Complete Encryption Coverage
Zero-Touch Key Management
Production-Ready Automation
Before: IT spends 15 minutes per device manually enabling FileVault, tracking keys in spreadsheets, and responding to "I forgot my password" tickets.
After: Automated deployment during device provisioning, centralized key management, and self-service recovery options reduce hands-on time to 3 minutes per device for monitoring only.
Stop playing audit roulette. Automated compliance reporting shows encryption status, key escrow verification, and remediation status for every device in real-time. No more last-minute scrambles during security assessments.
Modern Macs with T2 chips or Apple Silicon handle AES-XTS encryption with hardware acceleration. These rules include performance monitoring to prove FileVault isn't your bottleneck—and help you find what actually is.
The automation handles the complete encryption lifecycle, including synthetic boot testing and backup validation, ensuring business continuity throughout deployment.
Before: New hire gets laptop → IT manually runs FileVault setup → recovery key gets emailed/written down → key potentially gets lost → compliance gap
After: Device enrollment triggers automated FileVault enablement during Setup Assistant → recovery key automatically escrowed to Jamf → encryption status reported to security dashboard → zero manual intervention
# Automated during MDM enrollment
readonly FV_STATUS=$(fdesetup status)
if [[ $FV_STATUS != *"FileVault is On"* ]]; then
enable_fv_with_escrow
validate_escrow_receipt
fi
Before: macOS Sonoma update resets FileVault recovery key silently → old escrowed key becomes useless → device lockout requires hardware service
After: Post-update automation detects key change → immediately re-escrows new key → validates escrow receipt → updates compliance dashboard
# Triggered by macOS update detection
post_update_key_validation() {
if ! validate_current_escrow; then
sudo fdesetup changerecovery -personal
escrow_new_key_to_mdm
logger -t fv_automation "Recovery key rotated post-update"
fi
}
Before: Developers use unencrypted USB drives → sensitive data leaves encrypted endpoints unprotected → compliance violation
After: Automated policy blocks unencrypted external media → provides encrypted formatting workflow → ensures data never leaves devices unprotected
# External drive detection and enforcement
ensure_external_encrypted() {
local disk_info
disk_info=$(diskutil info "$1" | grep "FileVault")
[[ -n $disk_info ]] || block_and_educate_user "$1"
}
Deploy Base Configuration Profile
<!-- MDM Configuration Profile -->
<key>Enable FileVault</key>
<true/>
<key>Allow Deferred Enablement</key>
<false/>
<key>Escrow Personal Recovery Key</key>
<true/>
Install Automation Scripts
# Place in /usr/local/lib/filevault/
sudo mkdir -p /usr/local/lib/filevault
sudo chmod 755 /usr/local/lib/filevault
# Deploy fv_enable.sh, fv_status_check.sh, fv_rotate_key.sh
Configure Logging and Monitoring
# Set up centralized logging
readonly LOG_PATH="/var/log/fv_$(hostname).log"
exec > >(tee -a "$LOG_PATH") 2>&1
Enable Smart Group Targeting
Implement Key Escrow Validation
validate_escrow_receipt() {
local escrow_status
escrow_status=$(curl -sf "$ESCROW_API/validate/$SERIAL")
[[ $escrow_status == "valid" ]] || alert_ops_team
}
Deploy External Media Controls
Automated Health Monitoring
# Daily cron job
fdesetup status | grep -q "FileVault is On" || \
logger -s -t fv_monitor "ALERT: FileVault disabled on $(hostname)"
Quarterly Key Rotation
Performance Monitoring
# Benchmark disk performance
benchmark_disk_performance() {
time dd if=/dev/zero of=/tmp/test.img bs=1m count=1024 2>&1 | \
logger -t fv_performance
}
The FileVault automation framework transforms disk encryption from a manual, error-prone process into reliable security infrastructure. Your team stops managing encryption and starts leveraging it as the foundation for comprehensive endpoint protection.
Ready to eliminate encryption gaps and automate your way to compliance? Implement these rules and watch your macOS security posture transform from reactive to proactive.
You are an expert in macOS security, FileVault, APFS, Bash scripting, and MDM (Jamf, Kandji, Intune).
Key Principles
- Encrypt everything at rest: internal, external, and removable media.
- Prefer native Apple tooling first: FileVault, Disk Utility, fdesetup, profiles.
- Automate repeatable tasks with idempotent Bash or zsh scripts.
- Never lose a recovery key: escrow to MDM or secure vault immediately.
- Validate encryption status on every boot in CI / fleet reports.
- Treat disk-level encryption as the last line of defense—still follow least-privilege and secure-boot.
Bash / zsh
- Use `#!/usr/bin/env bash` for portable scripts; require macOS ≥ 12.
- Always quote variables ("$var") to prevent word-splitting.
- Exit on first error: `set -euo pipefail` and trap ERR with custom handler.
- Use `readonly` for constants (e.g., readonly ESCROW_URL).
Example:
```bash
readonly FV_STATUS=$(fdesetup status)
```
- Prefer `$(...)` over legacy back-ticks.
- Parse plist output with `/usr/libexec/PlistBuddy` or `defaults read`—never grep raw XML.
- Log via `logger -t <script-name>` so messages arrive in unified logging.
- Use functions; keep scripts ≤ 200 LOC.
```bash
ensure_encrypted() {
local status
status=$(fdesetup status | awk '{print $1}')
[[ $status == "FileVault" ]] || enable_fv
}
```
Error Handling and Validation
- Determine encryption state with `fdesetup status`; exit 0 if "On".
- Return non-zero exit codes for any failure so MDM sees remediation needed.
- On enable failures, immediately regenerate a fresh recovery key:
`sudo fdesetup changerecovery -personal`.
- Validate that personal or institutional key appears in `escrowinfo`.
- Collect serial, OS, and Secure Enclave status before enabling; abort if Secure Boot is disabled.
- Log all key-related operations but redact keys from stdout/stderr.
- Enforce early returns; avoid nested `if` blocks deeper than two levels.
MDM / Framework-Specific Rules
- Use a configuration profile with payload type `com.apple.MCX.FileVault2` to force encryption during Setup Assistant (macOS 14+).
- Set `Enable FileVault` = **On** and `Allow Deferred Enablement` = **False** for instant encryption.
- Always check-in escrow receipt: Jamf `Inventory > Management > Disk Encryption` should list a valid key.
- Handle rotation via `fdesetup changerecovery -personal` triggered by smart group "Key Age > 365 days".
- Require conformance with NIS2: store keys in geo-redundant vault with strict RBAC.
- During off-boarding, rotate recovery key and verify escrow before the device leaves custody.
External & Removable Media
- Format disks as `APFS (Encrypted)` using Disk Utility CLI:
```bash
diskutil eraseDisk APFSX "SecureData" /dev/disk2
```
- Use 12+ character passphrases; avoid plain FAT/ExFAT.
- Block unencrypted external media with Jamf’s restricted software / USB monitor.
Testing & Verification
- Automate health check:
```bash
fdesetup status | grep -q "FileVault is On" || exit 1
```
- Run synthetic boot test quarterly: decrypt → reboot → re-encrypt, ensuring no data loss.
- Benchmark performance pre/post-enable: `time dd if=/dev/zero of=test.img bs=1m count=2048`.
Performance Guidelines
- Expect < 2 % IO overhead on Apple Silicon (AES-XTS w/ Secure Enclave).
- Never disable FileVault for performance troubleshooting; profile IO first (`fs_usage`).
Security & Compliance
- Enforce complex user passwords (≥ 10 chars, alphanumeric) because FileVault inherits them.
- Enable Password-less recovery only through institutional key escrow; never share personal keys.
- Combine with Secure Boot: set `Full Security` in Startup Security Utility.
- Keep OS up-to-date; FileVault receives firmware-level patches.
Backup & Disaster Recovery
- Ensure Time Machine uses **encrypted** destinations (`tmutil setdestination <url>` with encryption flag).
- Validate ability to unlock disk using recovery key quarterly; store results in audit log.
- Document key-rotation SOP in runbooks accessible to L2 only.
Common Pitfalls
- Forgetting to escrow new key after macOS Sonoma major update → mitigation: schedule `fdesetup` escrow check post-upgrade.
- Grepping `fdesetup status` incorrectly (multi-language output) → mitigation: parse with `PlistBuddy -c Print` on `fdesetup status -plist`.
- Using Fusion Drive Macs (no T2 chip) without institutional key → recommend hardware refresh.
Directory & File Naming
- Store scripts under `/usr/local/lib/filevault/` with snake_case names:
`fv_enable.sh`, `fv_rotate_key.sh`.
- Logs: `/var/log/fv_<hostname>.log` (rotated weekly).
Sample One-Shot Enable Script
```bash
#!/usr/bin/env bash
set -euo pipefail
readonly LOG="/var/log/fv_onetime.log"
exec > >(tee -a "$LOG") 2>&1
main() {
if fdesetup status | grep -q "On"; then
echo "[OK] FileVault already enabled"; return 0
fi
echo "[INFO] Enabling FileVault…"
sudo fdesetup enable -user "$USER" -outputplist | \
/usr/libexec/PlistBuddy -c "Print :RecoveryKey" - > /tmp/recovery.plist
/usr/bin/curl -sSf -X POST --data-binary @/tmp/recovery.plist https://escrow.internal/api/v1/keys
rm /tmp/recovery.plist
echo "[SUCCESS] Encryption initiated. Reboot required."
}
main "$@"
```
Adopt these rules to achieve compliant, resilient, and automated disk-encryption management across your macOS fleet.