What it asks for. This control expects information stored on, processed by or accessible through user endpoint devices to be protected. The risks it addresses include loss, theft, malware and unauthorised access to information held on or reached through those devices.
In practice. Good practice is a topic-specific policy covering laptops, desktops and mobile devices, including registration, full disk encryption, screen locking, patching, endpoint protection and remote wipe. Rules for personally owned devices and for use outside the office are defined. Auditors expect the policy, device management records and compliance reports showing that settings are enforced.
Common gaps. Common gaps are unmanaged personal devices accessing company data, outdated operating systems and no process for lost or stolen devices. Local administrator rights and unencrypted removable media are further frequent weaknesses, as are devices of external contractors that fall outside management.