A.8.1
User end point devices
Technological controlsCheckpoints 6Evidence 6Cases 6
Control objective
Loss or compromise of a laptop, smartphone, or tablet can endanger stored work data and connected systems. This control defines permitted device data and safeguards, supported by registration, configuration, and user responsibilities. Possession of a device does not automatically grant information access; encryption, locking, authentication, and session protection affect that risk. Apply policy and technical safeguards suited to the device and its operating environment.
Key checkpoints
- Is there a policy defining secure configuration and use of user endpoint devices, and are users made aware of their responsibilities?
- Are endpoint devices that access organizational information registered/identified, and is ownership (corporate-issued / personally owned (BYOD)) distinguished?
- Is a technical baseline applied to endpoints: disk encryption, screen lock, malware protection, patching, and restriction of unauthorized software?
- Are loss/theft reporting and access-blocking procedures established, with remote lock/wipe applied and verified according to device support and authorized scope?
- For BYOD, are business and personal data separated, and are intellectual property/licensing/privacy matters handled with user consent?
- Is access to information and use of endpoints controlled according to network location/trust level, such as public networks or teleworking?
Implementation guidance
- Establish an endpoint device policy covering registration, permitted use, minimum security configuration, and user obligations, and obtain user acknowledgment/signature.
- Enforce the technical baseline through endpoint management (MDM/UEM): storage encryption, automatic screen lock, strengthened authentication, patching, and malware protection.
- Restrict installation of unauthorized software and control administrator privileges; for BYOD, separate business and personal areas through containerization/profiles.
- Link loss/theft reporting to incident response (A.5.24) and prepare prompt access blocking, including session/token revocation. Consider support and connectivity for remote lock/wipe; for BYOD, verify the authorized work-data scope and legal authority while protecting personal content.
- Apply least privilege, avoid storing sensitive data locally where risk is high (use centralized/virtual access), and control connections from untrusted public networks.
- On end of use, perform secure return/erasure (A.8.10) and access revocation, and ensure physical protection of off-premises devices (A.7.9).
Evidence
- Endpoint device security policy / acceptable use policy and user acknowledgment (signature) records
- Endpoint/device inventory (including BYOD) with ownership type and assignment status
- MDM/UEM configuration screens: encryption, screen lock, patch status, application control
- Loss/theft reporting records and remote lock/wipe execution logs
- Records of secure erasure/return and access revocation on end of use/offboarding
- BYOD agreements addressing separation of business/personal areas, privacy, and intellectual property/licensing
Nonconformity examples
- A laptop holding sensitive data is not encrypted, so information is exposed if it is lost or stolen.
- Endpoint devices are not registered/identified, so unmanaged devices access organizational information.
- Lost-device reporting/access blocking is absent or ineffective, with no alternative when remote lock/wipe cannot be performed.
- BYOD devices access business data with no separation from personal areas and no user consent procedure.
- Endpoint patching and malware protection are not applied consistently, leaving devices unpatched for a long time.
- Users are granted local administrator rights and install unauthorized software freely, neutralizing the baseline.