Establish an organization within AWS Organizations, deploy AWS Control Tower, and activate the strongly recommended controls (guardrails). Integrate all accounts into the organization and categorize them into organizational units (OUs).

Utilize the AWS CLI to identify all unencrypted volumes across all AWS accounts and execute a script to encrypt these volumes directly.

Generate a snapshot of each unencrypted volume, create a new encrypted volume from the snapshot, detach the original unencrypted volume, and replace it with the newly created encrypted volume.

Set up an organization in AWS Organizations, configure AWS Control Tower, and enable the mandatory controls (guardrails). Incorporate all accounts into the organization and categorize them into organizational units (OUs).

Enable AWS CloudTrail and set up an Amazon EventBridge rule to automatically detect and encrypt any unencrypted volumes.