Identity, Access & Endpoint Security

A lost device away from the office may contain cached data, active sessions, and access tokens. Checks to make Confirm device identity and last known location through a trusted channel, report it promptly, revoke sessions, and use approved lock or wipe controls. Review sign-in activity and data sensitivity, then document recovery or replacement steps....

Repeated compliance failures can come from stale inventory, policy mismatch, unsupported OS, or a device that has not checked in. Checks to make Compare device identity and last check-in with assigned policy, inspect the failing control and platform version, and verify management connectivity. Separate genuine noncompliance from reporting delay before...

A device can go silent because of network access, expired enrollment, a broken agent, or a device that has been retired without inventory cleanup. Checks to make Compare last check-in, device ownership, agent health, enrollment state, and connectivity. Verify the device is still in service before remediation, and distinguish stale records from active...

Repeated failures can result from unsupported software, management enrollment problems, or a genuine control gap. Checks to make Review the exact failing policy and device status, confirm check-in and ownership, and guide the user through approved remediation. Provide a time-bound exception only through the risk process and verify compliance after the...

Mobile email can expose business data through unmanaged devices, weak screen locks, local downloads, or stale sessions. Checks to make Set device enrollment and encryption requirements, require screen lock and MFA, control local data and copy behavior where supported, and define lost-device response. Test access removal and selective wipe so personal...

Shared devices blur user attribution and can retain data or sessions between employees. Checks to make Use named sign-ins where possible, set automatic session lock and clear user data between shifts, restrict local admin access, and verify logs identify the individual. Document approved shared-device workflows and review exceptions. When to get help...

A department transfer can leave device access and application permissions aligned to the old role. Checks to make Trigger an access review when role changes are recorded, map new duties to approved groups, remove obsolete access, and verify endpoint profiles or data access. Record exceptions and check that shared devices follow the employee’s new...

Protection can be disabled by a user action, software conflict, policy change, or malicious activity. Checks to make Confirm the device and last check-in, review endpoint events and recent software or policy changes, and assess whether other controls remain active. Restore protection through approved management tooling, preserve relevant evidence, and...