User Endpoint Devices - ISO 27001 Annex A Control
ISO 27001 Annex A 8.1
The laptop on a desk is where most security policies meet reality.
ISO 27001 Annex A 8.1 - User Endpoint Devices
User endpoint devices - laptops, desktops, mobile phones, tablets - are where most staff actually interact with information. They are also the most exposed assets in the estate. They travel, they connect to untrusted networks, they get lost, and they are the first point of compromise in most attacks. The control asks for these devices to be protected through technical configuration, monitoring and user behaviour.
Baseline technical controls include full disk encryption, automatic patching, anti-malware, screen lock with short idle timeout, and management through a central tool that lets the organisation enforce policy and respond to incidents. Mobile device management for phones and tablets brings the same protections to those devices. The combination protects against the most common loss and theft scenarios.
Beyond the device itself, the control covers what staff can do with it - what they can install, what networks they can connect to, what data they can copy off, and what they should do if it is lost or compromised. The endpoint policy should set these expectations and the technical controls should enforce them where practical.
Endpoint management is one of the highest-leverage investments in information security. A central tool that pushes patches, enforces encryption, controls software installation and provides remote wipe protects every device the same way without relying on each user to remember the rules.
The audit looks at consistency - whether the technical baseline is actually applied to every device or whether there are exceptions that have grown over time. A policy that requires encryption is no protection if a sample of devices turns out to be unencrypted. The endpoint management tool's reporting is usually the cleanest evidence.
Practical Compliance Guidance
Endpoint protection is described in the IMS1 manual at section 8.3 on IT equipment alongside the wider information security arrangements. The equipment register tracks issued devices.
| alphaZ document | How to use it |
|---|---|
| ISO 27001 Toolkit | The full alphaZ ISO 27001 toolkit covering manual, policies, procedures, registers and audit checklists. |
Note - all the above files can be downloaded with an alphaZ subscription.
