lock the startup process until the user provides a PIN (personal identification number) or inserts a removable drive (for example USB) with the startup key
The level of protection provided by BitLocker can be increased with a TPM version 1.2 or higher. Without such a module, BitLocker can be used, but the user has to insert a USB after hibernation.