Once one or more advanced encryption keys have been created, to encrypt attachments, open up Attachment types. Update an existing attachment type or create a new one, setting Advanced encryption key appropriately.
Attachments added to VSys of this type will now be encrypted. See apply encryption to existing attachments for dealing with pre-existing attachments that aren't yet encrypted.
Attachments to jobs? Locations? VSys Live downloadable files? Regardless of their attachment type, these attachments are never encrypted: they'd be pretty useless for download via VSys Live or attaching to e-mails if they were!