8.1 User endpoint devices
Requires information stored on, processed by or accessible through user endpoint devices to be protected.
5
artefacts
1
held by a system
3
at each review
hard
to go live
Endpoint management (MDM / EDR)
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration baselines for each device type and evidence of compliance across the estate, with the percentage of devices compliant · Endpoint management (MDM / EDR)
periodic reviewEvidence produced at each review
- Evidence of the protective measures in force, such as full disk encryption, endpoint detection, screen lock, patch currency and restriction of administrative rights · Vulnerability scanner / patch tooling
- Evidence of separation of organisational information on personally owned devices and of the ability to remove it · Endpoint management (MDM / EDR)
- Records of lost or stolen devices and the action taken, including remote wipe evidence · Endpoint management (MDM / EDR)
governing documentDocuments that govern the control
- The endpoint device policy covering corporate and personally owned devices, registration, permitted use and required protections · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Endpoint management (MDM / EDR) on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Compliance reported for devices that check in, silently excluding devices that have not connected for months
- Encryption enabled at build with no ongoing verification that it remains enabled and the recovery key escrowed
- Personally owned devices accessing mail and documents under a policy statement with no technical control behind it
- Local administrator rights retained by users, which undermines every other endpoint control
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.14 Secure disposal or re-use of equipment · 8.2 Privileged access rights