ISO 27001 A.8.1 User endpoint devices: What to Enforce on Which Devices, and How to Prove It
ISO 27001 A.8.1 User endpoint devices: decide which devices are in scope, what to enforce per tier and what evidence shows it works.
/Autenix/8 min read
A laptop is left in a taxi. Your policy says all laptops are encrypted, but the device list was last updated months ago and nobody can confirm this one was ever enrolled. A rule on paper does not secure an endpoint. A record of which devices exist and what state they are in does.
What A.8.1 User endpoint devices asks for
A.8.1 User endpoint devices is an Annex A control. You select it through risk treatment and record the decision in the Statement of Applicability (SoA). Its intent is to protect information on endpoint devices such as laptops, phones, tablets and workstations. ISO/IEC 27002 lists topics to consider, including registration, encryption, software installation, updates, malware protection, remote lock or wipe, and separating personal from corporate data. These are guidance, and your risk assessment decides which apply.
Boundaries with sibling controls:
Keeping the inventory belongs to A.5.9 (Inventory of information and other associated assets).
The remote working rules belong to A.6.7 (Remote working).
Physical protection of equipment away from your premises belongs to A.7.9 (Security of assets off-premises).
A.8.1 User endpoint devices covers the protections applied on the device itself.
Depends on: A.5.9 (Inventory of information and other associated assets). You cannot scope or evidence endpoint protection without knowing which devices exist.
Decide your A.8.1 User endpoint devices scope
Scope depends on who owns the device and what data reaches it.
| Profile | What is in scope | How the Endpoint Scope Matrix changes | When to review scope |
|---|---|---|---|
| Fully managed company devices | All issued laptops, phones and tablets | One main tier, plus a stricter tier for privileged or high-sensitivity roles | A new device class or role type appears |
| Mixed company and personal (BYOD) devices | Managed devices, plus personal devices that touch company data | Personal devices get a reduced tier: separated work data, enforced lock, and removal of work data only | Personal devices begin handling more sensitive data |
| Contractors and unmanaged devices | Only the access paths they use | Browser-only access with session controls instead of device enforcement, if the risk assessment supports it | Contractor access expands beyond the original scope |
What to exclude, minimize, or deprioritize
- Reduce: devices that only reach public or low-sensitivity information can carry lighter requirements. Record the decision and the risk behind it.
- Substitute: for unmanaged devices, limiting access to a browser session with no local download can replace device-level control, if you can show that data does not persist locally.
- Do not reduce: any device with administrative access, locally cached confidential data, or access to systems your risk assessment rates as critical. "It's only a phone" is not a risk-based reason to skip it.
What good looks like
A. Copy this: Endpoint Scope Matrix
Adapt the values to your own risk assessment. They are illustrative, not requirements.
| Element | Tier A (privileged or confidential data) | Tier B (routine managed) | Tier C (personal or unmanaged, limited access) |
|---|---|---|---|
| Registration | Enrolled before access is granted | Enrolled before access is granted | Registered or approved before access |
| Storage encryption | Required and verified | Required and verified | Work data separated or not stored locally |
| Screen lock | Shorter inactivity timeout (e.g. 5 min) | Standard timeout (e.g. 10 min) | Required by access conditions |
| Software installation | Restricted to approved sources | Restricted or monitored | Work data kept in a managed container |
| Updates | Shorter patch window (e.g. 7 days for critical) | Standard window (e.g. 14 days for critical) | Minimum supported version required |
| Malware protection | Required, with central visibility | Required, with central visibility | Risk-assessed |
| Remote lock/wipe | Full device | Full device | Work data only |
| Local backup | Per data classification | Per data classification | Work data excluded from personal backups unless approved |
| Exceptions | Time-bound, owner-approved, logged in the Endpoint Exceptions Log | Same | Same |
A document alone does not prove implementation. The records below do.
B. Bad vs. good
| Bad | Good |
|---|---|
| "All devices must be encrypted and kept up to date." | Tier A and B devices must show encryption enabled in the managed device export. Tier C devices must not store work data locally, which access configuration enforces. |
| Applies to unknown devices and cannot be checked. | Names the tier, the evidence and the owner. |
C. Measures and evidence
| Measure | Why it matters | What sufficient looks like | Evidence |
|---|---|---|---|
| Device registration coverage | Unregistered devices cannot be protected or reported on | Devices with access to Tier A or B systems appear in the inventory before access is granted | Managed device export; Device inventory comparison record; Endpoint Scope Matrix |
| Storage encryption | Limits exposure if a device is lost | Tier A and B devices show encryption on, with gaps logged | Encryption status report; Configuration sample record; Endpoint Exceptions Log |
| Patch currency | Reduces exposure to known weaknesses | Devices are within the tier's window, and overdue devices are tracked to a fix or an exception | Patch compliance report; Endpoint Exceptions Log |
| Remote lock/wipe capability | Limits the impact of loss or theft | A tested lock or wipe works for the relevant tier | Remote wipe test record |
| Exception handling | Shows deviations are controlled | Each exception has an owner, a reason and an end date | Endpoint Exceptions Log |
The example values are starting points, not requirements specified by ISO.
D. How to validate it yourself
- Inventory completeness. Compare the managed device export against HR records and your identity provider's device list. Success: no active user with Tier A or B access has an unregistered device, or the gap is on the Endpoint Exceptions Log. Record: the Device inventory comparison record.
- Configuration spot check. Pick a sample of Tier A and B devices and confirm encryption, lock and update settings in the console. Success: the settings match the Endpoint Scope Matrix. Record: the Configuration sample record.
- Wipe test. Run a remote lock or wipe on a test device. Success: the device responds as the matrix says. Record: the Remote wipe test record. This confirms capability on one device, not coverage across all of them.
- Exception review. Review the Endpoint Exceptions Log for expired or ownerless entries. Success: every entry has an owner and an end date. Record: the reviewed log.
Independent review adds value when you want a second view of how well your scope decisions hold up against your risk assessment. It is not required unless a genuine requirement applies to you.
Common implementation mistakes with A.8.1 User endpoint devices
- The policy covers laptops, but staff read email on phones. The risk assessment never counted mobile access. Fix: add phones and tablets to the Endpoint Scope Matrix, or document why they are out of scope.
- Encryption is enabled, but nobody checks. The setting is assumed. Fix: produce the Encryption status report and review it against the managed device export.
- BYOD is allowed by default. There is no list of which personal devices are permitted or under what conditions. Fix: define the Tier C conditions and record approved devices.
- Exceptions have no end date. A developer's unmanaged laptop is approved once and stays that way. Fix: give every entry in the Endpoint Exceptions Log an owner and an end date, and review the log.
See how Autenix Compliance as a Service maps your systems, frameworks and gaps.
If you have one afternoon
- Draft the Endpoint Scope Matrix with three tiers, using your own device types and data classes.
- Export your managed device list, compare it against HR or identity provider records, and log the gaps in an Endpoint Exceptions Log.
- Check encryption and lock settings on a sample of devices and save the Configuration sample record.
An afternoon will not complete the control, but it gives you a baseline to improve on.
How Autenix helps with A.8.1 User endpoint devices
Platform
Autenix Compliance is a continuous compliance platform for 35+ frameworks, including ISO 27001. Four of its listed features connect to the work above:
- Policy Generator has customizable policy templates with version control and change tracking. That fits keeping the Endpoint Scope Matrix as a versioned document.
- Risk Management has automated risk scoring and prioritization and control effectiveness monitoring. That supports the risk assessment behind your tier decisions.
- Audit Readiness offers automated evidence collection, an audit trail with version history, and evidence export in an auditor-ready format. That supports the evidence named above. Which items can be collected automatically depends on the integrations you connect, so check that your device management source is covered.
- Continuous monitoring sends real-time alerts when a control drifts. That helps you catch encryption that nobody checks, and BYOD with no approved list, between reviews.
The platform supports your evidence and documentation. It does not satisfy the control on its own.
Services
Autenix's Compliance as a Service delivers the platform as a managed service. Its Discover step maps your current systems, frameworks and gaps, which is the same ground as the inventory and configuration checks above. Setup, integrations and training are included. You still own the scope decisions, risk acceptance, exception approvals and the device settings themselves. The service is optional help with the setup and ongoing running of the platform, and the platform and service are designed to be used together.
Request an ISO 27001 demo to see how versioned policies, risk scoring and audit-ready evidence export fit around your afternoon checklist and validation steps. Request an ISO 27001 demo.