User endpoint devices

What the control asks

Information that sits on, is handled by or can be reached through user endpoint devices is to be protected. Purpose: guard information against the risks that come with using such devices. Guidance: set a topic-specific policy on securely configuring and handling endpoints, communicated to relevant staff, that considers: which information types and classifications a device may handle; device registration; physical protection; limits on installing software, for example controlled remotely by administrators; software and version requirements and how updates are applied, such as automatic updating; rules for connecting to information services, public networks or other off-site networks, for example requiring a personal firewall; access control; encryption of storage; malware protection; remote disabling, wiping or lockout; backup; use of web services and applications; user behaviour analytics (8.16); use of removable devices and whether physical ports such as USB can be disabled; and partitioning that keeps organizational information and software apart from other content on the device. For information too sensitive to be stored locally, add safeguards such as blocking offline downloads and local storage like SD cards. Enforce the policy through configuration management (8.9) or automated tools wherever possible. Users should know the requirements and their own duties: end sessions and stop services when finished; protect devices physically and logically when not in use and not leave devices with important information unattended; take care in public places, open offices and meeting areas, for example using privacy filters and avoiding reading confidential material where others can see; and guard devices against theft in vehicles, hotels and venues. A procedure for lost or stolen devices should reflect legal, regulatory, contractual (including insurance) and other requirements. Where personal devices (BYOD) are allowed, also consider separating personal and business use with supporting software; giving access only after users accept their duties, give up ownership of business data and agree to remote wiping, with regard to PII law; policies preventing disputes over intellectual property created on private equipment; access to private devices for checks or investigations, which law may block; and licensing terms that can make the organization liable for software on privately owned devices. For wireless, set procedures on configuring connections, such as disabling weak protocols, and on using connections with enough bandwidth for backups and updates. Other information: protections depend on whether devices stay inside secured premises or face outside threats; wireless backups can fail through limited bandwidth or devices being offline at backup time; some ports such as USB-C cannot be disabled because they carry power and display.

Purpose in the standard’s terms, in our words: Shields information from the risks that endpoint devices bring.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Asset management, Information protection; Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• The topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control
• Device management (MDM or endpoint management) reports showing enrolment, encryption, patch level, firewall and anti-malware status
• Configuration evidence for software installation restrictions, removable media or port controls and blocking of local storage for highly sensitive information
• User acknowledgement of endpoint responsibilities and, for BYOD, of data ownership and remote wipe terms
• The lost or stolen device procedure and records of its use
• Wireless configuration standards disabling weak protocols

Where audits commonly find gaps

• Devices outside device management access corporate email and files
• Encryption is assumed but not verified on every device
• BYOD is permitted without separation of business data or remote wipe consent
• Lost device reports are slow because users do not know the procedure

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (06.2.1, 11.2.8) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.10 Acceptable use of information and other associated assets
• 5.14 Information transfer
• 6.7 Remote working

Read the five attributes All 93 controls