Securing Macs in the enterprise
It almost goes without saying that full disk encryption should be turned on, although Apple’s implementation, FileVault, can occasionally be unreliable and will not work with certain types of disk configuration, such as RAID. It is available from the FileVault tab of the Security & Privacy system preferences pane by clicking Turn On FileVault.
If you lose the passwords for the accounts on the Mac, you can enter the “safety net” key that OS X generates to decrypt the drive and as a final precaution you can store this key with Apple.