Choose the control boundary deliberately
Software-protected containers, operating-system volume encryption and hardware-encrypted drives protect different layers. Compare pre-boot or device authentication, supported platforms, administrative needs, recovery, certification, tamper resistance and plaintext residue.
Policy requires delivery data to remain protected if a device is removed. The team compares USB Secure for a compatible Windows handoff, BitLocker To Go under managed Windows policy and a validated hardware-encrypted drive for higher-assurance cross-environment transfer control.
Run the control in five steps
- 01Write the threat model and required assurance before naming a product.
- 02Identify whether protection covers files, a volume or the hardware device.
- 03Check platform, privilege, recovery and key-management requirements.
- 04Test loss, removal, reconnect and recipient workflows.
- 05Document residual risks and the approval decision.
Preserve an accountable handoff record
Record control type, cryptographic boundary, supported systems, authentication point, recovery route, certification requirement, administrator dependency, test delivery data and approver.
Stop and investigate when
- Marketing language substitutes for a tested threat model.
- The team cannot state where plaintext exists.
- A software tool is called a hardware-encrypted drive.
State what the control does not prove
Do not equate with hardware-encrypted drives or untested Mac/Android compatibility. Validate the device, recipient environment, secret channel, plaintext residue and recovery workflow separately.
Windows USB questions
Is BitLocker the same as a hardware-encrypted USB drive?
No. They have different control and assurance boundaries.
Which option is always best?
None. Choose against policy, threat, recipient environment and recovery needs.
Sources for this decision
Links support specific control decisions and do not imply endorsement.