The full-disk encryption built into Windows and macOS covers endpoints for free, and enterprise platforms add central key management for databases, file servers and cloud storage. Compare key management, recovery key escrow and audit reporting.
Why it works
Lost or stolen unencrypted devices trigger breach notification costs. Encrypted data often falls under safe-harbor provisions in breach notification laws.
What to look for
Recovery keys should be escrowed centrally.
It should cover laptops, removable media, databases and backups.
Reporting should prove which devices are encrypted.