ISO 27001 A.8.1: User endpoint devices

Start with an endpoint security policy covering all device types - corporate and BYOD. Define what is expected for each category and make sure the rules are enforceable, not aspirational. Set up hardening baselines using CIS benchmarks or similar. The non-negotiables: full-disk encryption on every endpoint, automatic screen lock after inactivity, host-based firewall enabled, unnecessary services and ports disabled, local admin accounts locked down, BIOS/UEFI password protection, and secure boot turned on. Deploy endpoint protection on all devices. At minimum you want next-generation antivirus or EDR, host-based intrusion prevention, web filtering or DNS-based security, and a personal firewall. For high-security environments, add application whitelisting. Make sure everything is centrally managed with automatic updates and real-time reporting. Roll out an MDM or UEM platform. Use it to enforce policies, push software and patches, monitor compliance, and remotely wipe lost or stolen devices. No device should touch organisational resources without being enrolled first. Nail down patch management. Critical patches within 72 hours, everything else within 30 days. Automate deployment and monitor compliance. Consider conditional access policies that block unpatched devices from sensitive resources - nothing motivates timely patching like losing access. Protect data on the endpoints themselves. Deploy DLP tools, restrict or manage USB ports, control which apps can access organisational data, and use containerisation on BYOD devices. Require secure connections (VPN or ZTNA) for remote access.