ISO 27001 A.8.1: Protect user endpoint devices

What A.8.1 requires in practice

A.8.1 asks the organisation to protect information that sits on, passes through or is reached from user endpoint devices. That covers laptops, desktops, phones, tablets and similar equipment that people use for work. The wording is deliberately short: it names the outcome, protection, and leaves the choice of measures to risk treatment.

• Decide which devices may be used and for which information, including company-owned, shared and personally owned equipment.
• Put protective measures in place that fit that decision, such as storage protection, update handling and rules for what may be kept locally.
• Make sure users know what they are expected to do, and check that the measures actually operate.

The outputs are a defined endpoint position, configured devices and records showing the position holds. One way Sterling's teams express this is a device baseline; the control does not name a baseline, a product or a particular management console.

Define permitted information and use

Establish which devices may access which services and what information may be stored locally. A device used only to view limited information can need a different arrangement from one holding customer records offline. Consider the information classification, user role, working location and consequences of loss or compromise.

Distinguish company-owned, shared and personally owned devices. The business needs enough control and visibility to support the permitted activity. If it cannot enforce the necessary protection on a device, it should reconsider what that device may do rather than describe unsupported expectations as an implemented safeguard.

Build a coherent configuration

Endpoint settings should work together. Authentication, software updates, installation permissions, protection against malware, local storage and network connections affect each other. Define an appropriate baseline and a way to identify deviations. Where a technical setting can enforce a necessary rule reliably, avoid depending entirely on users remembering to apply it.

Consider operation away from the office. A device that rarely connects may miss updates or backups scheduled during its offline periods. Test the actual pattern of use and define how support reaches the person. A management dashboard showing a device enrolled months ago is not proof that it remains current or that necessary information is being preserved.

Why endpoint protection matters to the business

Endpoints are where staff open email, handle customer records and work outside the office, so they are the most frequent point of loss or compromise. A stolen laptop or an infected phone can expose client data, and clients who outsource work to you expect that exposure to have been thought through before access is granted. Weak endpoint control also slows growth: a remote or hybrid workforce is hard to scale when nobody can say which devices hold what. Clear decisions about devices reduce incident cost, make onboarding quicker and give sales teams a straight answer when a prospect asks how remote work is protected. Auditors tend to test this control by looking at real devices, so gaps surface quickly.

How to implement A.8.1

Treat endpoints as a population to be managed, not a set of individual machines.

1. Inventory device types and owners, and note which services and information each can reach.
2. Decide, by information classification, what may be stored locally and what must stay on central systems.
3. Define a baseline for each device class covering storage protection, updates, installation rights, screen locking and protection against malicious software.
4. Choose a way to detect devices that fall out of line, and decide who follows them up and how quickly users are supported.
5. Cover loss and theft: how users report it, how access is withdrawn and how any remaining information is dealt with.
6. Brief users in plain language on their part, then sample real devices, including ones that rarely connect, to see whether the baseline holds.
7. Record any exceptions, such as a device that cannot take the baseline, with the compensating restriction on what it may reach and an owner who accepts the remaining exposure.

Illustrative BPO example: personal laptops used for overflow work

Illustrative construction example: a tablet that stays offline

A hypothetical contractor uses tablets to collect site inspection information where connectivity is intermittent. The devices are managed centrally, but one team's working pattern means they regularly miss update and backup windows. Locally held records accumulate without the expected protection being confirmed.

The contractor revises the synchronisation and support arrangement to fit site work, defines responsibility for unresolved device status and checks successful transfer of required records. An authorised review follows a tablet through an offline period and its return to connectivity. The evidence shows what happens to information and updates under the real conditions, not just the nominal policy.

Make personal-device boundaries explicit

Where personal devices are permitted, explain the separation of personal and business use, the organisation's support and security access, and what happens when permission ends. Applicable privacy, employment and licensing requirements may affect the arrangement. Obtain suitable advice where necessary; a user acknowledgement cannot automatically create every access right the organisation might want.

Remote locking or deletion can be useful, but establish their scope and technical limits. Avoid assuming that a lost offline device can certainly be wiped or that business information can be removed without affecting personal content. A clear response process should deal with uncertainty and authorise actions appropriately.

Evidence and checks that matter

Common nonconformities with A.8.1

Endpoint findings usually come from the gap between what the policy says and what devices actually do.

• Laptops holding customer information with no protection of local storage, despite a stated rule.
• Personally owned devices reaching business systems with no decision recorded on what they may do.
• Devices that rarely connect and have missed updates for long stretches, unnoticed by the team.
• Departed staff devices not recovered or cleared, because the leaver process ignores equipment.
• Management console showing devices as compliant while a sample inspection shows otherwise.