In short: Sophos Device Encryption, previously Sophos Central Device Encryption, manages Windows BitLocker and macOS FileVault full disk encryption from the Sophos console. It stores recovery keys, reports encryption status and offers self-service key recovery, with no key servers to run. It is licensed alongside your Sophos endpoint subscription, monthly or on a fixed term.
What Sophos Device Encryption is
Sophos Device Encryption, previously listed as Sophos Central Device Encryption, does not replace the encryption built into your computers. It manages it. Windows devices use BitLocker and Macs use FileVault; Sophos switches encryption on through policy, stores recovery keys securely, monitors encryption status and offers self-service key recovery so users can regain access to their own device if they are locked out, which reduces helpdesk work.
There are no key management servers to run: the console is web-based and keys are held in your Sophos account. It is managed alongside Sophos Endpoint in the same console, so existing Sophos customers apply an encryption policy rather than adopt a new management tool.
What is included
| Feature | Included |
|---|---|
| Policy-based BitLocker encryption on Windows | Yes |
| Policy-based FileVault encryption on macOS | Yes |
| Recovery key storage in the Sophos console | Yes |
| Encryption status reporting for audits | Yes |
| Self-service key recovery for users | Yes |
| Managed in the same console as Sophos Endpoint | Yes |
Device Encryption can sit alongside any of the Sophos endpoint tiers, from Sophos Endpoint to MDR; we confirm the right licence for your subscription when we quote.
How Device Encryption is licensed
Device Encryption is its own licence type, held under the Encryption licences in your Sophos account. Sophos calculates usage per user and separately for each licence type, so a device can count towards Sophos Endpoint without counting towards Device Encryption; a device needs an encryption policy assigned, with encryption turned on, to use an encryption licence. Keeping the licence in step with your endpoint estate means every new laptop is encrypted by policy as soon as it is managed.
Through Forever Systems it can be billed monthly with your other Sophos licences, or on a fixed term aligned to your endpoint renewal. Ask us for a quote and we will confirm the count for your estate.
Requirements and deployment
Windows devices need an edition that includes BitLocker (Pro, Enterprise or Education) and ideally a TPM chip; Macs use FileVault, which is built into macOS. Before rolling out we check for devices already encrypted outside Sophos, take over their keys where possible and test recovery. Policies can be applied to groups so that, for example, laptops are encrypted first.
Buying Device Encryption through Forever Systems
- Audit: we check which computers are already encrypted, by whom, and where their recovery keys are kept today.
- Quote: ask us for a quote for Device Encryption, aligned to your Sophos Endpoint renewal date.
- Pilot: we encrypt a small group first, test self-service key recovery and brief your helpdesk.
- Roll out: we apply the policy to the rest of the estate and give you an encryption status report you can hand to auditors or your insurer.
- Manage: new devices are encrypted automatically by policy, and we keep the licence count in step.
Who it suits and how we help
Device Encryption suits any organisation with laptops that leave the office, where a lost device could become a reportable data breach under UK GDPR. Encryption evidence also helps with insurer questionnaires and with Cyber Essentials secure configuration. We deploy the policy, escrow keys, train your helpdesk on recovery and manage licences and renewals. For product detail see Sophos Central Device Encryption.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Sophos Device Encryption replace BitLocker?
No. It manages BitLocker on Windows and FileVault on macOS centrally, stores recovery keys and reports encryption status.
Is Device Encryption counted separately from Sophos Endpoint?
Yes. Sophos counts usage separately for each licence type, so a device can use a Sophos Endpoint licence without using a Device Encryption licence. A device uses an encryption licence once an encryption policy with encryption turned on is assigned to it.
Which Windows editions work with Sophos Device Encryption?
It manages BitLocker, so Windows devices need an edition that includes BitLocker, such as Pro, Enterprise or Education. Macs use FileVault, which is built into macOS.