In short: Harmony Endpoint Complete is the middle edition of Check Point Endpoint Security. It includes everything in Advanced, from anti-ransomware and EDR to sandboxing, plus data protection: full disk encryption with pre-boot authentication or managed BitLocker and FileVault, and encryption of USB and other removable media. It suits mobile workforces and organisations holding personal data.
What Complete adds to Advanced
Harmony Endpoint Advanced protects the device from attack. Complete also protects the data on it if the device, or a USB stick, is lost or stolen. The extra components are:
- Full Disk Encryption: the whole drive is encrypted, so data cannot be read without authenticating
- Media Encryption: users can create encrypted storage on removable devices for business data
You keep every Advanced component: threat prevention, firewall, application control, compliance, remote access VPN, browser security, EDR and sandboxing. See the Harmony Endpoint editions comparison for the full table.
How full disk encryption works
Check Point's Full Disk Encryption combines boot protection with strong disk encryption, so only authorised users can get at the data. You choose how it runs per policy:
- Check Point encryption with pre-boot authentication: users authenticate before the operating system loads
- BitLocker management on Windows: the agent manages Microsoft BitLocker through Windows interfaces, so you keep Microsoft's encryption engine but control it, and see its status, from the Check Point console
- FileVault management on macOS: Harmony Endpoint starts managing FileVault-encrypted disks automatically, without turning the encryption off
Encryption is set in the Data Protection policy and the component is added through the deployment policy; the client restarts to enforce it. Check Point documents a takeover route for Windows devices already encrypted with BitLocker: a BitLocker Management rule using the "Windows Default" algorithm brings them under central management without re-encrypting the disk (the device needs a TPM). Switching a device from BitLocker Management to Check Point's own encryption, by contrast, decrypts and re-encrypts the disk, so Check Point advises changing one group of users at a time. We plan that change-over, including recovery arrangements, before switching anything on.
Removable media encryption and port protection
Media Encryption lets users create an encrypted area on a USB drive or similar device for business data. In Windows Explorer the device then appears as two drives, one encrypted for business use and one unencrypted for non-business files, and your policy can set different access rights for each. If a user forgets the password, administrators can help them recover access remotely through Check Point's challenge and response Remote Help process.
Port protection, which is also in Advanced, controls which types of storage and peripheral device may connect to USB, Bluetooth and other ports, so you can block unauthorised devices outright and allow only approved or encrypted media. Media Encryption and Port Protection are supported on Windows and macOS clients.
UK GDPR, lost laptops and regulated sectors
UK GDPR does not name encryption as a legal requirement, but it does require appropriate technical measures, and the Information Commissioner's Office (ICO) says you should encrypt personal data held on laptops, PCs, phones, tablets and removable media. If an encrypted device is lost, the data is unintelligible to whoever finds it, which reduces the impact of the breach and can affect whether you need to tell the people affected. You still have to assess whether the breach must be reported to the ICO, and being able to show from one console that the lost laptop was encrypted makes that assessment far easier.
Complete is a common choice for:
- Professional services such as legal, accountancy and financial advisory firms, where client confidentiality obligations apply
- Healthcare and care providers handling special category data
- Education and public sector organisations with staff working from home or on the move
- Any business with sales or field staff carrying laptops and USB storage
The Cyber Essentials requirements do not themselves require disk encryption, so treat encryption as a UK GDPR and good-practice measure that sits alongside certification rather than as part of it.
Complete or Elite?
Stay on Complete if your main gaps are prevention, EDR and encryption. Choose Harmony Endpoint Elite when you also want:
- Posture management, to find and patch vulnerable operating systems and applications from the same agent (see posture management)
- Endpoint DLP and GenAI security, to control what data leaves via uploads, the clipboard, printing or AI tools
- Infinity XDR for Endpoint, to correlate incidents and automate responses with Playblocks
If you need just one of these, an add-on to Complete may be cheaper; if you need two or more, Elite usually makes more sense. We will quote both ways.
How we help
Forever Systems plans the encryption roll-out, including how to handle machines already using BitLocker or FileVault, recovery and Remote Help procedures, and USB policy, then deploys and supports it. Pricing depends on device numbers, add-ons and term, so ask us for a quote. Contact us to discuss Harmony Endpoint Complete.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between Harmony Endpoint Complete and Advanced?
Complete includes everything in Advanced plus full disk encryption and removable media encryption. Advanced has no encryption components, although it does include port protection to control USB and other devices.
Can Harmony Endpoint manage BitLocker?
Yes. Full Disk Encryption can use Check Point's own encryption with pre-boot authentication, or manage Microsoft BitLocker on Windows, so you can keep BitLocker but control and report on it from the Check Point console. On macOS it manages FileVault.
Does encrypting laptops help with UK GDPR?
Yes. UK GDPR requires appropriate security for personal data, and the ICO says you should encrypt personal data on laptops, phones, tablets and removable media. If an encrypted laptop is lost, the impact on individuals is much lower, which can affect whether you need to tell them, although you must still assess whether to report the breach to the ICO.
Can users still use USB sticks with Harmony Endpoint Complete?
Yes, under your rules. Media Encryption lets users create an encrypted business area on a USB drive, and port protection can block unapproved devices. Administrators can help users who forget their media password through Remote Help.