User end point devices

What the requirement asks

Information that sits on, is handled by or can be reached through user endpoint devices is to be protected. Purpose: guard information against the risks that come with using such devices. Guidance: set a topic-specific policy on securely configuring and handling endpoints, communicated to relevant staff, that considers: which information types and classifications a device may handle; device registration; physical protection; limits on installing software, for example controlled remotely by administrators; software and version requirements and how updates are applied, such as automatic updating; rules for connecting to information services, public networks or other off-site networks, for example requiring a personal firewall; access control; encryption of storage; malware protection; remote disabling, wiping or lockout; backup; use of web services and applications; user behaviour analytics (8.16); use of removable devices and whether physical ports such as USB can be disabled; and partitioning that keeps organizational information and software apart from other content on the device. For information too sensitive to be stored locally, add safeguards such as blocking offline downloads and local storage like SD cards. Enforce the policy through configuration management (8.9) or automated tools wherever possible. Users should know the requirements and their own duties: end sessions and stop services when finished; protect devices physically and logically when not in use and not leave devices with important information unattended; take care in public places, open offices and meeting areas, for example using privacy filters and avoiding reading confidential material where others can see; and guard devices against theft in vehicles, hotels and venues. A procedure for lost or stolen devices should reflect legal, regulatory, contractual (including insurance) and other requirements. Where personal devices (BYOD) are allowed, also consider separating personal and business use with supporting software; giving access only after users accept their duties, give up ownership of business data and agree to remote wiping, with regard to PII law; policies preventing disputes over intellectual property created on private equipment; access to private devices for checks or investigations, which law may block; and licensing terms that can make the organization liable for software on privately owned devices. For wireless, set procedures on configuring connections, such as disabling weak protocols, and on using connections with enough bandwidth for backups and updates. Other information: protections depend on whether devices stay inside secured premises or face outside threats; wireless backups can fail through limited bandwidth or devices being offline at backup time; some ports such as USB-C cannot be disabled because they carry power and display. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Endpoint devices are the largest attack surface. The guidance asks for the build, the protection, the patching, the encryption and the lost-device route.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control and one live sample together.

Evidence an assessor asks for

• Endpoint security policyThe topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control
• Endpoint security policyDevice management (MDM or endpoint management) reports showing enrolment, encryption, patch level, firewall and anti-malware status
• Endpoint security policyConfiguration evidence for software installation restrictions, removable media or port controls and blocking of local storage for highly sensitive information
• Endpoint security policyUser acknowledgement of endpoint responsibilities and, for BYOD, of data ownership and remote wipe terms
• Endpoint security policyThe lost or stolen device procedure and records of its use
• Endpoint security policyWireless configuration standards disabling weak protocols

The question an assessor will ask

An assessor will ask for the topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control, then trace it to the system it protects. For A.8.1 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Devices outside device management access corporate email and files
• Encryption is assumed but not verified on every device
• BYOD is permitted without separation of business data or remote wipe consent
• Lost device reports are slow because users do not know the procedure

Before the next audit

Before the next audit, check one live sample for this gap: devices outside device management access corporate email and files.