# Unencrypted Assets

**Categories:** Security

Automated detection of devices without full-disk encryption with compliance enforcement workflows.

- Runs periodic scans for devices without full-disk encryption
- Cross-references device inventory against encryption policy requirements
- Distinguishes newly flagged devices from those already being tracked
- Notifies device owners with the guidance needed to enable encryption
- Opens a compliance ticket for IT to remediate
- Auto-resolves once encryption is confirmed active

## What Unencrypted Assets does

Unencrypted Assets is Harmony's automated monitoring workflow for identifying company-owned devices where disk encryption is disabled or in an unknown state. Running on a daily schedule, Harmony queries MDM-managed devices for missing or unconfirmed disk encryption, optionally notifies device owners directly to enable encryption, generates a CSV report, and creates an IT desk ticket with all affected devices. Unencrypted devices are a critical security and compliance risk - this workflow ensures IT knows about them immediately rather than discovering them during an audit or incident.

## Who Unencrypted Assets Is For

**Persona:** IT security and operations teams responsible for endpoint encryption compliance.

**Pain point:** Disk encryption (BitLocker, FileVault) policies are easy to configure but hard to audit at scale without tooling. A device where encryption failed to apply, was manually disabled, or was never configured can go undetected for months. Regulatory frameworks (HIPAA, SOC 2, ISO 27001) require encryption on all managed endpoints - this workflow creates the recurring compliance check that confirms coverage.

## How Unencrypted Assets Works

**Trigger:** A cron schedule fires (default: daily at 8 AM UTC). Schedule and timezone are configurable per tenant.

1. **Query unencrypted devices** - The workflow queries MDM-managed, company-owned devices for those where disk encryption is not confirmed as enabled (either disabled or unknown encryption state).

2. **Owner notifications (optional)** - If notifications are enabled, Harmony sends a direct message to each device owner notifying them that their disk encryption is not enabled, with a configurable frequency gate (default: once per 7 days per device). VIP employee exclusion is supported.

3. **Ticket filtering** - Notification results are merged into the device records for the ticket CSV.

4. **CSV report** - All unencrypted devices are serialized into a CSV report (unencrypted_assets_report) including a "Last Notification" column.

**Outcome:** A ticket titled "Devices With Unencrypted Disks Detected" is created in the IT desk with the CSV attached.

## Capabilities

- **Disk encryption status monitoring** - Queries MDM-managed devices for those where disk encryption is disabled or not confirmed as enabled.
- **Owner notifications** - Optionally sends a Slack or Teams DM to the device owner notifying them that encryption is not enabled on their device, enabling self-service remediation.
- **Notification frequency gate** - Tracks when each owner was last notified and suppresses repeat messages within the configured window (default: 7 days per device).
- **VIP employee exclusion** - Configurable option to skip notifications for employees marked as VIP.
- **CSV report with notification history** - The IT ticket CSV includes a "Last Notification" column so IT can see which owners have been notified.
- **Configurable schedule** - Cron schedule and timezone are fully configurable per tenant (default: daily).
- **Ticket toggle** - Ticket creation can be independently disabled if only owner notifications are desired.

## Main use cases

**Daily Encryption Compliance Audit** - IT security requires daily verification that all company laptops have BitLocker or FileVault enabled - a common requirement for HIPAA, SOC 2, and CIS Controls compliance. The daily workflow queries all MDM-managed devices for missing encryption, creates a ticket with the full CSV, and ensures IT has a fresh, dated record of any compliance gaps each morning.

**Employee Self-Remediation** - IT wants employees to enable encryption themselves without requiring IT to manually reach out to each one. With notifications enabled, the workflow sends the device owner a DM explaining that their device encryption is not enabled and what to do. Many employees can enable FileVault or BitLocker themselves, reducing IT's remediation workload.

**Pre-Audit Compliance Verification** - A security audit is coming up and IT needs to confirm that all managed devices have encryption enabled. The CSV report provides a current, structured list of all devices lacking confirmed encryption - audit-ready evidence of what was detected and when it was flagged.

## Integrations

| Integration | Role in the agent flow |
| --- | --- |
| MDM / Device Management (internal) | Source of device encryption status - the MDM (Jamf, Intune, etc.) reports whether disk encryption is enabled per device |
| Asset Management API (internal) | Company-owned device records; the encryption status from MDM is read through this layer |
| Service Desk (internal) | IT ticket created with CSV; tracked for remediation |
| Notifications system (Slack/Teams) | Sends direct encryption warning to device owners when notifications are enabled |

## FAQ

### What exactly is Unencrypted Assets monitoring - is it a bot, a workflow, or something else?

It's a scheduled Harmony workflow, not an interactive chatbot. It runs on a cron schedule (default: daily), queries MDM-managed device encryption status, and produces owner notifications and/or IT tickets based on what's found.

### How does it know if a device is encrypted?

It reads the disk encryption status reported by the MDM (such as Jamf, Microsoft Intune) for each device. A device is flagged if encryption is explicitly disabled or if the encryption status is unknown (not confirmed as enabled).

### What does it handle and what does it hand off to a human?

Harmony handles detection, owner notifications, and IT ticket creation automatically. It doesn't remotely enable encryption - that's the device owner's or IT's responsibility. The workflow flags the risk; humans remediate it.

### Why flag "unknown" encryption status as well as explicitly disabled?

An unknown status means the MDM hasn't confirmed that encryption is enabled - which could indicate the device was enrolled without encryption being applied, the MDM policy failed, or the device hasn't checked in recently. Treating unknown the same as disabled is the conservative, security-first approach.

### What does it need to be connected to before it works?

An MDM integration must be configured and syncing device encryption status into Harmony's asset management layer. The notification system (Slack or Teams) must be set up if owner notifications are desired. The workflow template must be explicitly enabled per tenant (disabled by default).