User endpoint devices
Purpose
Safeguard the information that lives on, runs through or is reachable from laptops, phones and other user endpoint devices.
How to meet this control
In short: Protect information on user endpoint devices.
- Step 01Enrol every laptop and phone into a mobile device management platform such as Microsoft Intune, Jamf or Google Endpoint Management, and refuse network or app access to unenrolled devices
- Step 02Push a baseline profile that forces full-disk encryption (BitLocker on Windows, FileVault on macOS), a screen lock with a short idle timeout and a minimum PIN or passphrase
- Step 03Run an endpoint protection or EDR agent (Microsoft Defender, CrowdStrike, SentinelOne) on all devices and report compliance back to the MDM
- Step 04Stand up a conditional access rule in the identity provider so only compliant, managed devices can reach email and business applications
- Step 05For staff using their own phones, deploy app protection policies that containerise corporate data and allow a selective wipe that leaves personal data untouched
- Step 06Document a lost-or-stolen device runbook that triggers remote lock and wipe and revokes the device session tokens
Tip: MDM with disk encryption, screen lock, and remote wipe.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Write a topic-specific policy covering how endpoints are configured and handled
- ›Register devices, define what data classifications they may hold, and require physical protection
- ›Control software installation, keep software and updates current, and apply storage encryption
- ›Enforce access controls, malware protection, backups and remote wipe or lockout
- ›Tell users to lock unattended devices, guard against theft and use privacy screens in public
- ›Restrict or block removable media and disable physical ports such as USB where feasible
- ›For BYOD, separate personal and business data, get users to accept remote-wipe terms, and address IP
- ›Set procedures for theft or loss and secure wireless connections by disabling weak protocols
Audit evidence to keep
- - MDM enrolment report showing the full device fleet and compliance status
- - Screenshot of the encryption and screen-lock configuration profile applied to devices
- - Conditional access policy requiring device compliance for application access
- - Acceptable use or BYOD policy signed by staff, including remote-wipe consent
- - A worked example of a remote wipe or lock being actioned from the MDM console
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.8.1. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.