[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-1":3},{"item":4,"lessons":16,"controls":26,"related":44},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-1","Annex A 8.1","ISO\u002FIEC 27001:2022 Annex A 8.1: User endpoint devices",2,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects information stored on, processed by or accessible through user endpoint devices to be protected. The risks it addresses include loss, theft, malware and unauthorised access to information held on or reached through those devices.\n\n**In practice.** Good practice is a topic-specific policy covering laptops, desktops and mobile devices, including registration, full disk encryption, screen locking, patching, endpoint protection and remote wipe. Rules for personally owned devices and for use outside the office are defined. Auditors expect the policy, device management records and compliance reports showing that settings are enforced.\n\n**Common gaps.** Common gaps are unmanaged personal devices accessing company data, outdated operating systems and no process for lost or stolen devices. Local administrator rights and unencrypted removable media are further frequent weaknesses, as are devices of external contractors that fall outside management.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22],{"slug":19,"title":20,"published_at":21},"stolen-laptop-exposes-personal-data-resulting-in-dual-fines-for-polish-controller-and-processor","Stolen Laptop Exposes Personal Data, Resulting in Dual Fines for Polish Controller and Processor","2026-08-05T08:20:55.861+00:00",{"slug":23,"title":24,"published_at":25},"stolen-unencrypted-laptop-triggers-gdpr-fines-for-controller-and-processor","Stolen Unencrypted Laptop Triggers GDPR Fines for Controller and Processor","2026-07-30T14:20:23.867+00:00",[27,31,35,40],{"slug":28,"name":29,"problem":30,"stories":9},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":32,"name":33,"problem":34,"stories":9},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":36,"name":37,"problem":38,"stories":39},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",1,{"slug":41,"name":42,"problem":43,"stories":39},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[45,50,54,58,63,67,71,75],{"family":46,"item":47,"code":48,"title":49,"together":9},"gdpr","28","Article 28","Processor",{"family":46,"item":51,"code":52,"title":53,"together":9},"25","Article 25","Data protection by design and by default",{"family":46,"item":55,"code":56,"title":57,"together":9},"32","Article 32","Security of processing",{"family":59,"item":60,"code":61,"title":62,"together":9},"cis","4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":46,"item":64,"code":65,"title":66,"together":39},"24","Article 24","Responsibility of the controller",{"family":59,"item":68,"code":69,"title":70,"together":39},"14","Control 14","Security Awareness and Skills Training",{"family":59,"item":72,"code":73,"title":74,"together":39},"3","Control 3","Data Protection",{"family":59,"item":76,"code":77,"title":78,"together":39},"12","Control 12","Network Infrastructure Management"]