A system, comprising: a setup module (170, 210) to generate an encryption key and to transmit the encryption key to a basic input/output system (BIOS) security module, where the BIOS security module (150, 290, 590) is to use the encryption key as a basis for a heartbeat; a provisioning module (140, 220) to receive a signal identifying a monitored storage (120, 250, 550), to generate an enforced storage (55, 125, 255, 555) associated with the monitored storage (120, 250, 550) and a manifest describing the relationship between the enforced storage (55, 125, 255, 555) and the monitored storage (120, 250, 550), and to transmit the manifest to the BIOS security module (150, 290, 590); and a versioning module (110, 230) to: assign, based on the manifest, a first access policy for the monitored storage (120, 250, 550) and a second access policy for the enforced storage (55, 125, 255, 555); perform versioning for the monitored storage using the enforced storage by creating a backup version of the files from the monitored storage (120, 250, 550) to the enforced storage (55, 125, 255, 555), and, upon detecting changes to files in the monitored storage (120, 250, 550), store copies of files in the enforced storage (55, 125, 255, 555) according to a backup policy; periodically verify operation to the BIOS security module by periodically reading a heartbeat value from the BIOS security module (150, 290, 590), where reading the heartbeat value comprises decrypting the heartbeat value; and periodically transmit the decrypted heartbeat value to the BIOS security module (150, 290, 590). a setup module (170, 210) to generate an encryption key and to transmit the encryption key to a basic input/output system (BIOS) security module, where the BIOS security module (150, 290, 590) is to use the encryption key as a basis for a heartbeat; a provisioning module (140, 220) to receive a signal identifying a monitored storage (120, 250, 550), to generate an enforced storage (55, 125, 255, 555) associated with the monitored storage (120, 250, 550) and a manifest describing the relationship between the enforced storage (55, 125, 255, 555) and the monitored storage (120, 250, 550), and to transmit the manifest to the BIOS security module (150, 290, 590); and a versioning module (110, 230) to: assign, based on the manifest, a first access policy for the monitored storage (120, 250, 550) and a second access policy for the enforced storage (55, 125, 255, 555); perform versioning for the monitored storage using the enforced storage by creating a backup version of the files from the monitored storage (120, 250, 550) to the enforced storage (55, 125, 255, 555), and, upon detecting changes to files in the monitored storage (120, 250, 550), store copies of files in the enforced storage (55, 125, 255, 555) according to a backup policy; periodically verify operation to the BIOS security module by periodically reading a heartbeat value from the BIOS security module (150, 290, 590), where reading the heartbeat value comprises decrypting the heartbeat value; and periodically transmit the decrypted heartbeat value to the BIOS security module (150, 290, 590). assign, based on the manifest, a first access policy for the monitored storage (120, 250, 550) and a second access policy for the enforced storage (55, 125, 255, 555); perform versioning for the monitored storage using the enforced storage by creating a backup version of the files from the monitored storage (120, 250, 550) to the enforced storage (55, 125, 255, 555), and, upon detecting changes to files in the monitored storage (120, 250, 550), store copies of files in the enforced storage (55, 125, 255, 555) according to a backup policy; periodically verify operation to the BIOS security module by periodically reading a heartbeat value from the BIOS security module (150, 290, 590), where reading the heartbeat value comprises decrypting the heartbeat value; and periodically transmit the decrypted heartbeat value to the BIOS security module (150, 290, 590).