Checklist · Servers

Laptop and endpoint baseline

The standard configuration for company laptops, whether Windows, macOS or Linux.

Owner: IT supportTime: 20 min per deviceISO 27001 A.8.1ISO 27001 A.8.7ISO 27001 A.8.9

0 of 14

Encryption and access

Full-disk encryption on (BitLocker, FileVault or LUKS) and the recovery key escrowed.
Screen lock after 5 minutes or less; a firmware or boot password is set where supported.
Standard user by default; local admin only through an approved, logged elevation.
Sign-in with the identity provider and MFA; passwordless or a hardware key for privileged staff.

Software and protection

Enrolled in device management, which can lock and wipe the device remotely.
Operating system and browser update automatically; maximum age of a pending update is set.
EDR/antimalware agent running, tamper-protected and reporting.
Host firewall on; file sharing and remote login services off unless needed.
Only approved software; a request route exists so people do not work around it.

Data and handover

Work data lives in company storage and is synced, not left only on the device.
Removable media policy applied; data loss prevention rules active where required.
The device is in the asset inventory against a named user.
The user has been told how to report a lost device, and does so the same day.
On return, the device is wiped and re-imaged, and the disk key is destroyed.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed. ISO references show where a list helps, not that it satisfies a control.

See these as tasks in Cisodium All checklists

Klar til å gå
forbi klassisk GRC?

14 dagers gratis prøve. Ikke noe kort. Nettskyen eller on-premises.

Bestill demo Snakk med salg →

Laptop and endpoint baseline

Encryption and access

Software and protection

Data and handover

Klar til å gåforbi klassisk GRC?

Klar til å gå
forbi klassisk GRC?