Key takeaways
- Protect information on laptops, phones and other user devices.
- Endpoints are where users meet data, and where most attacks land.
- Start here: enrol all endpoints in device management.
Purpose
Protect information on laptops, phones and other user devices.
Requirement
Requirement summaryInformation stored on, processed by or accessible via user endpoint devices shall be protected.
Why it matters
Endpoints are where users meet data, and where most attacks land.
How to implement
- Enrol all endpoints in device management.
- Enforce encryption, screen lock, updates and anti-malware.
- Define rules for personal devices if allowed.
- Report on device compliance regularly.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.1. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your device policy: security rules for laptops, phones and tablets.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.1 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list of company devices showing they are managed and meet the rules (encryption, updates, screen lock, malware protection).
- Examples of devices that fell out of line and how they were fixed.
- Proof staff accepted the device rules.
Things you should be able to show or explain
- Be able to show how settings are enforced on devices.
How much to show: 10 or so devices across operating systems.
Common mistakes
- Unmanaged devices accessing company data.
- Encryption not enforced.
- Developer machines exempted from controls.
- Unknown devices accessing company email.
- Tip: Use MDM to enforce encryption, PINs and updates.
Policies & documents to have
- Asset Management Policy
- Data Management Policy
- Information Security Policy
- Operations Security Policy
FAQ
Is A.8.1 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.1?
Be ready to explain how the control works in your organisation and to provide things like: Your device policy: security rules for laptops, phones and tablets…