ISO 27001 Annex A 8.1 Protection of user endpoint devices
What it says
Information stored on, processed by or accessible via user end point devices shall be protected.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all laptops, mobiles, and tablets are secure to protect stored information.
This control is all about keeping your devices like laptops, phones, and tablets secure. If they're not protected, sensitive information could be lost or stolen, potentially harming your organisation's reputation and finances. It's like locking the doors to your house to keep your belongings safe.
Free. Save your status, tasks and notes.
Why it matters
If user endpoint devices are compromised, attackers can access or exfiltrate data stored on or reachable via the device, causing breaches and loss.
How to implement
The IT manager should develop a policy for securing all user devices.
This policy should define how devices like laptops and smartphones should be configured and used. It should include rules on how software updates are managed and what security features must be enabled.
HR should ensure that all employees receive training on this policy.
This can be done through initial onboarding sessions and regular refreshers. Use real-life scenarios to make the importance of these policies clear and relatable.
The IT manager should implement tools to enforce these security settings automatically.
This could involve using technology that remotely manages device configurations and updates. Ensure these tools are compliant with Australian regulations like the Privacy Act 1988.
Procurement should ensure new devices comply with the security policy before purchase.
This means checking that devices support required security features like encryption and remote locking. This can be confirmed through vendor specifications and certifications.
The board should regularly review reports from the IT team to ensure devices remain compliant.
This involves setting up regular reporting cycles and reviewing compliance metrics. Hold discussions on any issues or risks highlighted in these reports.
Keep it running
Use full-disk encryption, prompt OS/app patching, EDR/anti-malware with monitoring, and device hardening (screen lock, MDM, least privilege) for endpoints.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the organisation's policy on user endpoint device security.
Look at
Check if the policy includes guidelines on device configuration, software updates, and access controls.
Good evidence
The policy should be comprehensive, up-to-date, and communicated across the organisation.
- Check 2 of 5What an auditor asks for
Ask for
Request evidence of training programs on securing user devices.
Look at
Examine training materials and attendance records for completeness and relevance.
Good evidence
Training should be regularly updated and mandatory for all employees, with high participation rates.
- Check 3 of 5What an auditor asks for
Ask for
Request records of device configuration management tools in use.
Look at
Verify the tools cater to all device types and apply updates automatically when needed.
Good evidence
Tools should be robust, ensuring all devices are compliant with the latest security standards.
- Check 4 of 5What an auditor asks for
Ask for
Request documentation on device procurement procedures.
Look at
Check that security compliance is a criteria during the procurement process.
Good evidence
There should be evidence that security features are verified before new devices are approved for use.
- Check 5 of 5What an auditor asks for
Ask for
Request recent compliance reports or dashboards presented to the board.
Look at
Check for trends, identified risks, and actions taken to mitigate those risks.
Good evidence
Reports should show ongoing compliance with security policies and proactive risk management.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.5, Configure Microsoft Office to prevent activation of OLE packages, which this control covers in full and more.
ASD Essential Eight: 2 mappings
This control is broader than E8-AH-ML2.5.
E8-AH-ML2.5 requires a Microsoft Office endpoint configuration to prevent activation of OLE packages. Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, which includes hardening endpoint applications like Office. Annex A 8.1 is broader and outcome-focused, while E8-AH-ML2.5 is a specific application hardening measure contributing to that endpoint protection objective.
This control is broader than E8-RA-ML3.6.
E8-RA-ML3.6 requires a specific endpoint hardening measure: enabling Credential Guard for secure credential storage. ISO/IEC 27001:2022 Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, which is a broader outcome-based control. Enabling Credential Guard is one concrete technical implementation that helps satisfy Annex A 8.1 for the subset of endpoint information that is credential material.
ASD Information Security Manual: 40 mappings
This control is broader than ISM-0345.
ISM-0345 requires a specific endpoint protection measure: disabling external interfaces that allow DMA to block a direct memory access attack path. Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, covering a wide range of endpoint controls (e.g. hardening, encryption, access control, and configuration). ISM-0345 is one concrete technical safeguard that can be implemented to help satisfy the broader endpoint-protection intent of Annex A 8.1.
This control is broader than ISM-0489.
ISM-0489 requires that cached SSH private keys in SSH-agent style tools have a maximum lifetime of four hours and that screen locks are used where applicable to prevent misuse of unattended sessions. This aligns with ISO/IEC 27001:2022 Annex A 8.1, which requires protection of information accessible via user endpoint devices, including controls that prevent unauthorised use of active sessions and exposed credentials. Annex A 8.1 is broader, covering many endpoint protections beyond SSH key caching and screen locking.
This control is broader than ISM-0682.
ISM-0682 requires Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices to reduce proximity-based compromise and uncontrolled short‑range data transfer. This aligns with Annex A 8.1, which requires protection of information on user endpoint devices through appropriate configuration and hardening, including disabling unnecessary interfaces on mobile endpoints. ISM-0682 is a highly prescriptive endpoint configuration requirement for a specific radio interface and classification context, whereas Annex A 8.1 is broader and covers the full set of endpoint protections (e.g. secure configuration, protection of stored data, and endpoint controls) across device types.
This control is broader than ISM-0687.
ISM-0687 requires ASD-approved mobile platforms for accessing SECRET or TOP SECRET systems or data, with operation aligned to the applicable Australian Communications Security Instruction. Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, including mobile devices. ISM-0687 is a narrowly defined endpoint assurance requirement for classified mobile access, whereas Annex A 8.1 is broader and covers many endpoint protection measures beyond platform approval.
This control is broader than ISM-0701.
ISM-0701 requires mobile device emergency sanitisation processes and procedures to be developed, implemented and maintained. Emergency sanitisation (for example wiping a device at risk of compromise or loss) is a specific measure for protecting information stored on or accessible via endpoint devices as required by Annex A 8.1. Annex A 8.1 covers all protections for user endpoint devices, while ISM-0701 addresses only emergency sanitisation of mobile devices.
This control is broader than ISM-0853.
ISM-0853 requires interactive user sessions to be terminated and workstations to be restarted at least daily to reduce persistence of processes, clear volatile state, and limit exposure from unattended sessions. ISO/IEC 27001:2022 Annex A 8.1 requires protection of user endpoint devices, which commonly includes hardening measures such as enforced logoff/lock, session timeouts, and restart policies. ISM-0853 is a specific operational endpoint-hardening practice, while Annex A 8.1 is broader and can be satisfied through multiple endpoint controls beyond daily restarts.
This control is broader than ISM-0864.
ISM-0864 requires mobile devices to prevent personnel from disabling or modifying provisioned security functionality. ISO/IEC 27001:2022 Annex A 8.1 requires protection of information on, processed by, or accessible via user endpoint devices, which includes mobile device security as part of broader endpoint protection. ISM-0864 is a specific technical enforcement mechanism within endpoint protection, whereas Annex A 8.1 covers a wider range of endpoint risks and safeguards beyond configuration immutability.
This control is broader than ISM-0866.
ISM-0866 requires users to avoid viewing sensitive or classified information on mobile devices in public unless they can minimise the risk of screen observation. Annex A 8.1 mandates the protection of information stored on, processed by, or accessible via user endpoint devices, covering a wide range of endpoint protections. ISM-0866 functions as a specific confidentiality safeguard aimed at visual privacy within the broader scope of endpoint device protection outlined in Annex A 8.1.
This control is broader than ISM-0869.
Annex A 8.1 requires protection of information stored on and accessible via user endpoint devices. ISM-0869 directly contributes by requiring encryption of mobile device internal storage and removable media, reducing the impact of device loss or unauthorised access. ISM-0869 is a subset of Annex A 8.1 because it addresses storage encryption on mobiles rather than comprehensive endpoint security across device types.
This control is broader than ISM-0870.
Annex A 8.1 requires organisations to protect information stored on or accessible via endpoint devices. ISM-0870 addresses a key endpoint risk by requiring mobile devices to be carried or stored in a secured state when not in active use, helping prevent loss/theft and subsequent data compromise. ISM-0870 is narrower because it focuses on physical handling/storage, while Annex A 8.1 also includes technical controls and broader device protections.
This control is broader than ISM-0871.
ISM-0871 requires mobile devices to be kept under continual direct supervision when they are being actively used to reduce loss or theft. Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, which includes mobile devices and extends beyond physical supervision to technical and administrative protections. ISM-0871 is one concrete physical/behavioural measure that contributes to endpoint device protection, but it does not cover the broader endpoint security controls implied by Annex A 8.1.
This control is broader than ISM-0874.
Annex A 8.1 requires organisations to protect information accessible via endpoint devices such as laptops and mobiles. ISM-0874 mandates routing internet access for mobile devices and desktop computers through a VPN to the organisation's internet gateway, which helps protect endpoint traffic and reduces exposure when endpoints are off-network. ISM-0874 is narrower because it focuses on network path/remote access controls rather than the full set of endpoint device protections in Annex A 8.1.
This control is broader than ISM-1059.
Annex A 8.1 requires organisations to protect information stored on, processed by, or accessible via user endpoint devices. ISM-1059 specifically mandates encryption for all data stored on media, which is one important mechanism for protecting endpoint-resident data (e.g., laptop disks, removable media used with endpoints). ISM-1059 is narrower because it focuses on encryption of stored data, while Annex A 8.1 also covers broader endpoint protections (configuration, access controls, malware protection, physical protection, etc.).
This control is broader than ISM-1082.
ISM-1082 requires the organisation to develop, implement and maintain a mobile device usage policy that governs how mobile devices are used. ISO/IEC 27001:2022 Annex A 8.1 requires protection of information on or accessible via user endpoint devices, which typically includes mobiles and is implemented through technical and procedural controls. ISM-1082 is one policy instrument that can contribute to meeting A 8.1, but A 8.1 is broader and expects actual protection measures beyond policy alone.
This control is broader than ISM-1084.
ISM-1084 addresses physical protection during transport by mandating approved security bags when a mobile device cannot otherwise be secured. Annex A 8.1 requires organisations to protect information stored on, processed by, or accessible via user endpoint devices, which includes mobile devices across many protection domains. ISM-1084 is one concrete physical-handling measure that can be used to help meet Annex A 8.1, but Annex A 8.1 also expects broader technical and administrative protections beyond transport.
This control is broader than ISM-1195.
Annex A 8.1 requires protection of information on user endpoint devices, which commonly relies on consistent configuration and policy enforcement. ISM-1195 requires the use of evaluated Mobile Device Management (MDM) to enforce mobile device management policy, directly supporting secure configuration and control of mobile endpoints that store or access organisational data. ISM-1195 is narrower because it focuses on an MDM assurance/enforcement mechanism for mobiles, while Annex A 8.1 covers all endpoint protections more generally.
This control is broader than ISM-1196.
Annex A 8.1 requires protection of information accessible via user endpoint devices, including mobiles and tablets. ISM-1196 reduces exposure to nearby device attacks by requiring mobile devices to remain undiscoverable via Bluetooth except during pairing, which supports protecting data accessible on those endpoints. ISM-1196 is a specific wireless-hardening requirement and does not address the full range of endpoint security obligations in Annex A 8.1.
This control is broader than ISM-1198.
ISM-1198 requires Bluetooth pairing on non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices to be performed so connections are only made between intended Bluetooth devices. ISO/IEC 27001:2022 Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, which includes controlling endpoint connectivity and peripheral/wireless interfaces to prevent unauthorised connections and data exposure. ISM-1198 is a technology-specific control that fits within Annex A 8.1's broader endpoint protection objective, but Annex A 8.1 also covers many other endpoint protections (e.g., configuration, malware protection, access control) beyond Bluetooth pairing.
This control is broader than ISM-1199.
ISM-1199 requires Bluetooth pairings to be removed from non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices when they are no longer required. This relates to Annex A 8.1 because removing unnecessary Bluetooth pairings reduces attack surface and unauthorised connectivity pathways on user endpoint devices. Annex A 8.1 is broader, covering protection of endpoint devices across many controls (e.g. configuration, hardening, and broader endpoint safeguards) beyond Bluetooth pairing hygiene.
This control is broader than ISM-1200.
Annex A 8.1 requires protecting information accessible via endpoint devices, including reducing the risk of unauthorised access through local wireless interfaces. ISM-1200 mandates secure Bluetooth pairing methods for specified mobile devices, reducing the likelihood of interception or unauthorised pairing that could expose data or device access. ISM-1200 is a narrow technical requirement for a specific interface and does not cover the broader endpoint protection obligations of Annex A 8.1.
This control is broader than ISM-1341.
Annex A 8.1 requires protecting information stored on or accessible via endpoint devices, including detecting and preventing malicious activity on endpoints. ISM-1341 requires implementing a HIPS or EDR solution on workstations, which directly strengthens endpoint protection against compromise and data exposure. ISM-1341 is narrower because it prescribes one technical control (endpoint detection/prevention) whereas Annex A 8.1 encompasses a broader range of endpoint safeguards.
This control is broader than ISM-1400.
ISM-1400 requires organisations to enforce separation of classified work data from personal data on privately-owned endpoint devices used to access sensitive systems or data. Annex A 8.1 requires protection of information stored on, processed by or accessible via user endpoint devices, which can be achieved partly through separation mechanisms (e.g. work profiles, containers, managed apps). ISM-1400 is narrower because it focuses on BYOD and data separation, whereas Annex A 8.1 covers endpoint protection more generally (e.g. hardening, encryption, malware protection, access controls).
This control is broader than ISM-1482.
ISM-1482 requires enforced separation of classified data from personal data on organisation-owned mobile devices and desktop computers. Annex A 8.1 requires protection of information stored on, processed by, or accessible via endpoint devices, which can include controls like containerisation, separate user profiles, and managed storage that enable such separation. Annex A 8.1 is broader because it covers endpoint protection generally (e.g. hardening, encryption, patching, configuration), not specifically the classified-versus-personal segregation requirement.
This control is broader than ISM-1533.
ISM-1533 requires the organisation to develop, implement and maintain a mobile device management (MDM) policy. This is a direct subset of ISO/IEC 27001:2022 Annex A 8.1, which requires protection of information on user endpoint devices and is typically implemented via endpoint-specific policies and controls (including mobile device management rules). Annex A 8.1 is broader because it covers all endpoint types and protection outcomes, whereas ISM-1533 is specifically the governance requirement to have an MDM policy for mobile devices.
This control is broader than ISM-1585.
ISM-1585 requires locking down browser security settings so human users cannot disable or reduce protections. ISO/IEC 27001:2022 Annex A 8.1 requires protection of information on or accessible via user endpoint devices, which commonly includes securing endpoint applications like browsers that handle web content and credentials. Locking browser settings per ISM-1585 supports the endpoint protection objective in Annex A 8.1, but Annex A 8.1 is broader and includes many other endpoint safeguards beyond browser configuration.
This control is broader than ISM-1686.
ISM-1686 requires enabling Credential Guard as a specific technical control to protect user credentials from unauthorised access on Windows endpoints. Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices more broadly. ISM-1686 is one specific mechanism that can contribute to meeting Annex A 8.1, but Annex A 8.1 also covers many other endpoint protections beyond credential isolation.
This control is broader than ISM-1749.
ISM-1749 requires the number of cached logon credentials on a system to be limited to one previous logon. This directly protects information stored on user endpoint devices, as required by Annex A 8.1, by reducing the credential material an attacker could extract from a lost, stolen or compromised workstation. Annex A 8.1 covers the full range of endpoint device protections, whereas ISM-1749 is a single hardening setting for credential caching.
This control is broader than ISM-1866.
ISM-1866 requires personnel on privately-owned mobile devices or desktop computers to be prevented from storing classified data locally. ISO/IEC 27001:2022 Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices. ISM-1866 is one specific endpoint-protection outcome (no classified local storage on BYOD), whereas Annex A 8.1 applies to endpoint devices more generally and covers a wider set of protection mechanisms.
This control is broader than ISM-1867.
Annex A 8.1 requires organisations to protect information stored on, processed by, or accessible via endpoint devices. ISM-1867 strengthens endpoint assurance by requiring evaluated mobile platforms and operation in accordance with ASD configuration guidance for devices accessing OFFICIAL: Sensitive or PROTECTED systems/data. ISM-1867 is a specialised platform assurance requirement and represents one way to meet Annex A 8.1, but Annex A 8.1 remains broader across device types and control measures.
This control is broader than ISM-1868.
ISM-1868 requires that SECRET and TOP SECRET mobile devices do not use removable media unless ASD approval is obtained beforehand. Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, which includes controlling risky peripherals and storage interfaces (such as removable media) on mobile devices. ISM-1868 is a specific, high-assurance restriction for a particular classification and device context, whereas Annex A 8.1 is broader and less prescriptive about approvals and classification-specific prohibitions.
This control is broader than ISM-1886.
ISM-1886 requires mobile devices to be configured to operate in supervised (or equivalent) mode to enforce stronger device management and security controls. This relates directly to ISO/IEC 27001:2022 Annex A 8.1, which requires protection of information on or accessible via user endpoint devices, including mobiles. ISM-1886 is a specific technical configuration approach for mobiles, while Annex A 8.1 is broader and technology-agnostic across all endpoint device types and protective measures.
This control is broader than ISM-1887.
Annex A 8.1 requires protecting information stored on and accessible via endpoint devices, particularly against loss or theft. ISM-1887 mandates remote locate and wipe functionality for mobile devices, which directly mitigates data exposure by enabling rapid response to lost or stolen endpoints. ISM-1887 is a specific mobile security capability and therefore a subset of the broader endpoint protection expectations in Annex A 8.1.
This control is broader than ISM-1888.
ISM-1888 focuses on one specific endpoint protection measure: enforcing secure lock screens on mobile devices. Annex A 8.1 requires protection of information stored on, processed by, or accessible via user endpoint devices, which commonly includes screen lock, authentication and other endpoint hardening measures. ISM-1888 is therefore a specific implementation detail that contributes to satisfying the broader endpoint protection intent of Annex A 8.1.
This control is broader than ISM-1896.
ISM-1896 requires enabling memory integrity functionality as a specific technical safeguard to protect credentials from memory-based attacks on endpoints. This is a concrete endpoint protection mechanism that fits within ISO/IEC 27001:2022 Annex A 8.1, which broadly requires protecting information on, processed by, or accessible via user endpoint devices. Annex A 8.1 covers a wider range of endpoint controls (e.g. configuration hardening, malware protection, encryption), while ISM-1896 is one specific hardening configuration aimed at credential protection.
This control is broader than ISM-2097.
ISM-2097 requires mobile devices to use always on VPN functionality to reduce exposure of data accessed or transmitted by the device. This supports Annex A 8.1 by helping protect information that is accessible via endpoint devices when they connect over external or hostile networks. Annex A 8.1 is broader and includes many other endpoint protections (e.g. configuration hardening, encryption, malware controls) not addressed by VPN alone.
This control partially meets ISM-0591.
ISM-0591 requires organisations to use evaluated peripheral switches when sharing peripherals between systems to prevent security breaches through shared devices. This relates to Annex A 8.1 (Protection of user endpoint devices) as it is a specific endpoint-protection measure, while Annex A 8.1 covers a wider range of protections including device hardening.
This control partially meets ISM-1554.
ISM-1554 requires heightened protection for user endpoint devices during overseas travel to high or extreme risk countries by using newly provisioned accounts and dedicated work-only travel devices and applying tamper seals. Annex A 8.1 requires organisations to protect information stored on, processed by, or accessible via user endpoint devices in general. ISM-1554 is a specific, high-risk travel subset of endpoint protection, adding travel-specific operational measures (e.g. tamper-evidence inspection and avoiding personal rooted/jailbroken phones) beyond the generic endpoint requirement.
This control partially meets ISM-1898.
ISM-1898 requires a specific endpoint type (Secure Admin Workstations) to be used for administrative activities to protect privileged actions and associated data. ISO/IEC 27001:2022 Annex A 8.1 requires protection of user endpoint devices more generally, covering all endpoints and the information they store/process/access. ISM-1898 is a specific, privileged-administration-focused implementation that fits within the broader endpoint protection requirement of Annex A 8.1.
This control partially overlaps ISM-0161.
ISM-0161 requires physical security for unused IT equipment and media to prevent unauthorised access. ISO/IEC 27001:2022 Annex A 8.1 overlaps by requiring protection of user endpoint devices, which commonly includes controls like locking devices away when unattended and preventing unauthorised physical access. Annex A 8.1 extends beyond physical security into technical protections (configuration, access control, encryption), while ISM-0161 is focused on securing the equipment/media when not in use.
This control supports ISM-1080.
ISM-1080 requires use of ASD-approved/high assurance algorithms when encrypting media to protect data at rest from unauthorised access. This supports ISO/IEC 27001:2022 Annex A 8.1 by providing a concrete mechanism (strong, approved encryption) to protect information stored on or accessible via endpoint devices. Annex A 8.1 is broader because it includes multiple endpoint protections beyond encryption (e.g. configuration, access restrictions, malware controls), whereas ISM-1080 addresses the cryptographic strength of encryption for stored data.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.