A system, comprising: a setup module to generate an encryption key and to transmit the encryption key to a basic input/output system (BIOS) security module, where the BIOS security module is to use the encryption key as a basis for a heartbeat; a provisioning module to receive a signal identifying a monitored storage , to generate an enforced storage associated with the monitored storage and a manifest describing the relationship between the enforced storage and the monitored storage , and to transmit the manifest to the BIOS security module ; and a versioning module to: assign, based on the manifest, a first access policy for the monitored storage and a second access policy for the enforced storage ; perform versioning for the monitored storage using the enforced storage by creating a backup version of the files from the monitored storage to the enforced storage , and, upon detecting changes to files in the monitored storage , store copies of files in the enforced storage according to a backup policy; periodically verify operation to the BIOS security module by periodically reading a heartbeat value from the BIOS security module , where reading the heartbeat value comprises decrypting the heartbeat value; and periodically transmit the decrypted heartbeat value to the BIOS security module . a setup module to generate an encryption key and to transmit the encryption key to a basic input/output system (BIOS) security module, where the BIOS security module is to use the encryption key as a basis for a heartbeat; a provisioning module to receive a signal identifying a monitored storage , to generate an enforced storage associated with the monitored storage and a manifest describing the relationship between the enforced storage and the monitored storage , and to transmit the manifest to the BIOS security module ; and a versioning module to: assign, based on the manifest, a first access policy for the monitored storage and a second access policy for the enforced storage ; perform versioning for the monitored storage using the enforced storage by creating a backup version of the files from the monitored storage to the enforced storage , and, upon detecting changes to files in the monitored storage , store copies of files in the enforced storage according to a backup policy; periodically verify operation to the BIOS security module by periodically reading a heartbeat value from the BIOS security module , where reading the heartbeat value comprises decrypting the heartbeat value; and periodically transmit the decrypted heartbeat value to the BIOS security module . assign, based on the manifest, a first access policy for the monitored storage and a second access policy for the enforced storage ; perform versioning for the monitored storage using the enforced storage by creating a backup version of the files from the monitored storage to the enforced storage , and, upon detecting changes to files in the monitored storage , store copies of files in the enforced storage according to a backup policy; periodically verify operation to the BIOS security module by periodically reading a heartbeat value from the BIOS security module , where reading the heartbeat value comprises decrypting the heartbeat value; and periodically transmit the decrypted heartbeat value to the BIOS security module . <EOS>