Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Control A.8.1User endpoint devices

Information stored on, processed by or accessible via user endpoint devices must be protected.

The endpoint is where most information is actually handled and where the organisation’s controls are thinnest, because the device leaves the building and is operated by someone who is not a security specialist.

What the control expects follows from the risk: configuration and hardening under A.8.9, malware protection under A.8.7, patching under A.8.8, encryption at rest under A.8.24, the ability to lock or wipe a lost device, and rules about what may be stored locally at all.

Personally owned devices are the part that needs an explicit decision. Permitting them without a boundary between the organisation’s information and the owner’s puts the organisation in the position of needing to wipe a device it does not own, which is a conversation better had in advance — and in the EU also engages the privacy considerations A.5.34 raises.

How to put this in place

Laptops, phones and tablets are where company information most often leaves your control. In an ISMS project you need a known, enforced baseline for every device that reaches company data, or one lost or unpatched device undoes the rest of your controls.

  1. Inventory the device types that reach company data, including personal ones.
  2. Decide the minimum standard: encryption, screen lock, updates and malware protection.
  3. Enrol devices in central management and enforce the standard.
  4. Block or limit access from devices that do not comply, and set a clear rule for personal devices.
  5. Set a routine to lock and wipe devices that are lost or held by people who leave.
  6. Review non-compliant devices on a fixed cycle and act on them.

Evidence an auditor usually looks for: device management compliance reports, access rules that block non-compliant devices, the written personal device rules, and records of devices wiped.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

  • Annex A Control Implementation LibraryExcel

    Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.

  • Statement of Applicability TemplateExcel

    Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.