macOS FileVault is also a good option for whole-drive encryption, as the hardware then requires the external password in order to unlock the drive to continue booting.