Summary of this is: Encryption is Automatic and Ever there for Marshmallow. Especially the CM13 you are operating on. 
[![encryption state][1]][1] [![os version][2]][2] [![encryption type][3]][3]
But protecting your device is your choice. The system wants to give you liberty to do what you like so it won't enforce data security even if encryption is available. When setting lock screen security, there's a question about, liking to protect your device by asking a pattern, password or PIN. This means when device switches off, and this option is on, it runs an encrypting script so as on the next bootup the phone demands the pattern to decrypt. Even TWRP will ask you for a code so as to mount `/data`. Note that if the whole root partition is encrypted, the device won't even use the **boot.img** and recovery since they rest at `/dev/platform/[memory.name]/by-name/boot.img` and /dev/platform/[memory.name]/by-name/recovery.img hence encryption only affects the `/data` partition, anyway, encryption is for protecting your data from unauthorized access not the system from accessing it's runtime essentials. Failure to agree to that prompt well count your device as decrypted and it's not encrypted on shutdown again hence it behaves like a decrypted device which is put aware to you when it tells you, "device protection features will not work on this device". That's what Android does, if you want a more practical visible type of encryption try BlackBerry 7 OS encryption and it's precedent devices. It will encrypt media, sdcards, and they won't even work on your computer through drag to copy. Unless you send then by bluetooth or any recognized upload.


  [1]: https://i.sstatic.net/BYbjp.jpg
  [2]: https://i.sstatic.net/u59WA.jpg
  [3]: https://i.sstatic.net/26pfa.jpg