ISO 27001 A.8.1: User Endpoint Devices

ISO 27001 A.8.1 requires that information stored on, processed by, or accessible through user endpoint devices, meaning laptops, desktops, phones, and tablets, is protected. It is a Technological control (A.8), and the action teams get flagged on most is the device inventory: a fleet the team believes is fully managed turns out to include contractor laptops, personal phones used for production access, and machines that never made it into the MDM console.

What is ISO 27001 A.8.1?

ISO 27001 A.8.1 User endpoint devices governs the protection of information held on or reachable through the devices people use to do their work. ISO/IEC 27001:2022, Annex A frames the control around protecting information against the risks that come from using endpoint devices, including devices that leave the office and devices owned by staff. In the 2022 revision it consolidates the separate 2013 controls on mobile devices and teleworking (the old A.6.2 family) into one technological control that covers every category of user endpoint.

A user endpoint device is any device an individual uses to access, hold, or process company information: corporate laptops and desktops, tablets, smartphones used for email or multi-factor authentication, and personal devices under a bring-your-own-device arrangement. A.8.1 is deliberately technology-neutral. It does not name a management platform or an operating system. What it requires is that endpoints are inventoried, configured to a security baseline, protected against loss and malware, and governed by a policy staff agree to.

How do you implement A.8.1?

Implementing ISO 27001 A.8.1 comes down to a sequence a team can follow regardless of where the infrastructure lives:

1. Maintain a device inventory. Record every endpoint in scope with its owner, operating system, enrollment status, and last check-in. The inventory is the reference every later step and every auditor works from, and it is where scoping gaps get caught.
2. Enforce full-disk encryption. Every laptop and mobile device encrypts data at rest so a lost or stolen device does not expose company data. This is the single most consequential endpoint control after inventory.
3. Apply a configuration baseline through device management. Push a managed baseline covering password and passcode rules, screen lock and idle timeout, firewall state, and OS configuration, so every device is provisioned the same way rather than by hand.
4. Deploy EDR or anti-malware on every endpoint. Endpoint detection and response, or at minimum maintained anti-malware, runs on each device and reports coverage back to a central console. This connects to the malware control A.8.7, which covers the anti-malware program in depth.
5. Keep endpoints patched. Operating system and application updates are applied on a defined cadence, verified through the management console rather than left to the user.
6. Enable remote wipe for lost or stolen devices. A documented procedure covers reporting the loss, initiating a remote wipe, and revoking credentials cached on the device.
7. Publish a BYOD and acceptable-use policy. A written policy states which devices are permitted, what controls apply to personal devices, and what staff agree to when they use a device for company work. Acknowledgement records tie each user to the policy.

Steps 2 through 6 implement meaningfully differently in cloud-managed and on-prem environments. The two subsections below cover each. One note before them: virtual desktop infrastructure does not remove the endpoint control obligation. A team that routes work through a VDI still has to verify the device connecting to it, since conditional access checks the posture of the connecting endpoint, so the laptop or phone reaching the virtual desktop stays in scope for A.8.1. Decisions like these, where endpoint posture gates access to the rest of the environment, are security architecture decisions and deserve a deliberate design pass rather than a tooling default.

In cloud environments

Cloud-managed endpoints implement A.8.1 through a cloud MDM or UEM platform, with device posture enforced at the point of access:

• Cloud MDM enrollment through Microsoft Intune, Jamf, or Kandji pushes the configuration baseline, encryption policy, and screen-lock rules, and reports each device's compliance state to a central console.
• Conditional access with device posture gates access to company applications on the device being enrolled, encrypted, and compliant, so a non-compliant or unknown device is blocked before it reaches data.
• Cloud-managed EDR such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint provides behavioral detection and a coverage report drawn from one console.
• Encryption enforced through policy turns on FileVault, BitLocker, or mobile device encryption and reports the encrypted state back to the MDM.
• Remote wipe from the console lets an administrator wipe a lost or stolen device and confirm the action in the management log.

On-prem / self-hosted

On-prem environments reach the same outcomes through imaged builds and directory-driven configuration, producing their own evidence. The SOC 2 endpoint security on-prem guide covers the full implementation across mixed fleets; the shape is:

• Standard imaged builds provision each laptop from a hardened base image with encryption, anti-malware, and the local firewall enabled from day one.
• Group Policy or configuration management enforces password rules, screen-lock timeout, and OS settings across domain-joined machines.
• Local full-disk encryption through BitLocker or LUKS, with recovery keys escrowed centrally rather than held on the device.
• Asset tags and a maintained register tie each physical device to an owner and a location, since there is no cloud enrollment record to lean on.
• A documented lost-device procedure covering credential revocation and, where a management agent is present, a remote wipe, since a purely on-prem device may not be reachable once it leaves the network.

Cloud vs on-prem at a glance

What evidence demonstrates A.8.1?

Evidence for ISO 27001 A.8.1 is paired: a configuration artifact showing the control exists on each endpoint, plus a coverage or review record showing it holds across the fleet. Teams that pull these coverage reports automatically from the MDM and EDR consoles, instead of assembling screenshots each audit cycle, are practicing GRC engineering.

A common gap that comes up during readiness work is a policy that says one thing and a fleet that does another. In one engagement, a team enforcing endpoint password rules through their management platform found the enforcement caused erratic behavior on Mac devices, triggering password reset cycles whenever the screensaver activated, so they disabled enforcement to keep the machines usable. That left a policy requiring password complexity with no technical control behind it and no evidence anyone followed it. The resolution was to separate enforcement from detection: where enforcement broke the user experience, they configured the platform to detect and report compliance status instead, then ran periodic checks that verified each device met the policy. The evidence chain became policy, plus a detection report, plus a periodic review, plus a remediation ticket for any non-compliant device. A.8.1 and its SOC 2 counterpart expect logical access controls to be in place and monitored; neither standard mandates one specific enforcement mechanism.

How does A.8.1 map to SOC 2?

ISO 27001 A.8.1 is a Full overlap with SOC 2 CC6.7. Organizations with an existing SOC 2 program can reuse the same endpoint evidence for the ISO 27001 certification audit with little adaptation.

CC6.7 governs the protection of data in transit and at rest, and endpoint disk encryption is the part of that criterion A.8.1 carries. The SOC 2 to ISO 27001 control mapping covers the full crosswalk and where SOC 2 work transfers to ISO 27001.

Related controls

ISO 27001 A.8.1 works alongside several controls that govern how endpoints are protected and where they operate. A.8.7 Protection against malware covers the anti-malware and EDR program that runs on each endpoint, and A.8.9 Configuration management covers the baseline enforcement that keeps devices in a known state. A.6.7 Remote working addresses the policy and controls for staff working outside the office, and A.7.9 Security of assets off-premises covers the physical protection of devices that leave company premises. The ISO 27001 certification guide is the hub for how these controls fit into a full ISMS.

Frequently Asked Questions

What is ISO 27001 A.8.1?

ISO 27001 A.8.1 User endpoint devices is a Technological control in Annex A of ISO/IEC 27001:2022. It requires that information stored on, processed by, or accessible through user endpoint devices such as laptops, desktops, phones, and tablets is protected. It covers device inventory, disk encryption, a configuration baseline, screen lock, anti-malware, patching, remote wipe, and a device-use policy, and it consolidates the 2013 mobile device and teleworking controls into one control.

What evidence satisfies A.8.1?

A.8.1 evidence is paired: a configuration artifact plus a coverage record. Auditors expect a device inventory with owner and enrollment status, an MDM configuration profile and disk-encryption status report, an EDR or anti-malware coverage report, a BYOD and acceptable-use policy with acknowledgements, a demonstrated remote-wipe capability, and a patch compliance report. The coverage report is what shows the control holds across the whole fleet rather than on a sample device.

How do you handle BYOD under ISO 27001 A.8.1?

Start with a written BYOD and acceptable-use policy that states whether personal devices are permitted, prohibited, or restricted, and what controls apply when they are used for company work. Where BYOD is allowed, apply device posture checks before granting access, require encryption and screen lock, and separate company data so it can be wiped without touching personal data. Record each user's acknowledgement of the policy so the scoping decision is documented and defensible.

Is A.8.1 a new control in ISO 27001:2022?

No. A.8.1 is not new to the 2022 revision. It consolidates the earlier controls on mobile devices and teleworking (the 2013 A.6.2 family) together with endpoint protection expectations into a single Technological control. The consolidation reduced the control count without removing the underlying endpoint security requirements.

Does using VDI remove the need for endpoint controls under A.8.1?

No. Virtual desktop infrastructure shifts endpoint requirements rather than removing them. Conditional access to a virtual desktop still checks the posture of the connecting device, which requires an agent, and the connecting laptop or phone still needs encryption, anti-malware, and patching before access is granted. The device reaching the virtual desktop stays in scope for A.8.1, so a lightweight MDM deployment is often simpler than treating VDI as a way to avoid endpoint management.

How does A.8.1 map to SOC 2 CC6.7?

A.8.1 maps to SOC 2 CC6.7 as a Full overlap. CC6.7 governs the security of transmitted and stored data, and endpoint disk encryption is the part of that criterion A.8.1 carries. Evidence produced for CC6.7, including disk encryption configurations and status reports, device inventory, MDM configuration profiles, and key management records, is reusable for the ISO 27001 A.8.1 requirement with little adaptation.