Checklist · Servers

Laptop and endpoint baseline

The standard configuration for company laptops, whether Windows, macOS or Linux.

Owner: IT supportTime: 20 min per deviceISO 27001 A.8.1ISO 27001 A.8.7ISO 27001 A.8.9

0 of 14

Encryption and access

Full-disk encryption on (BitLocker, FileVault or LUKS) and the recovery key escrowed.
Screen lock after 5 minutes or less; a firmware or boot password is set where supported.
Standard user by default; local admin only through an approved, logged elevation.
Sign-in with the identity provider and MFA; passwordless or a hardware key for privileged staff.

Software and protection

Enrolled in device management, which can lock and wipe the device remotely.
Operating system and browser update automatically; maximum age of a pending update is set.
EDR/antimalware agent running, tamper-protected and reporting.
Host firewall on; file sharing and remote login services off unless needed.
Only approved software; a request route exists so people do not work around it.

Data and handover

Work data lives in company storage and is synced, not left only on the device.
Removable media policy applied; data loss prevention rules active where required.
The device is in the asset inventory against a named user.
The user has been told how to report a lost device, and does so the same day.
On return, the device is wiped and re-imaged, and the disk key is destroyed.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed. ISO references show where a list helps, not that it satisfies a control.

See these as tasks in Cisodium All checklists

Prêt à aller
au-delà du GRC classique ?

Essai gratuit de 14 jours. Sans carte bancaire. Cloud ou on-premises.

Demander une démo Parler aux ventes →

Laptop and endpoint baseline

Encryption and access

Software and protection

Data and handover

Prêt à allerau-delà du GRC classique ?

Prêt à aller
au-delà du GRC classique ?