Identity, Access & Endpoint Security

Personal devices may access work accounts without the same monitoring, update, and data controls as company devices. Checks to make Define permitted access and minimum security requirements, use identity and application controls, limit local data storage where possible, and document support boundaries. Provide a managed alternative for tasks that...

Temporary staff may have short-term access to business devices and data but still need consistent endpoint controls. Checks to make Use managed accounts and devices, limit access to the role and duration, require MFA, and define return or wipe steps at end of engagement. Confirm device compliance before sensitive access and revoke sessions when the...

A returned device needs secure custody and access review whether or not all accessories are present. Checks to make Record device identifiers and condition, confirm encryption and management status, revoke user sessions, and decide whether to retain, reassign, or wipe the device. Track missing accessories separately and verify the laptop is not still...

A device sent for repair may expose local data or remain signed in to business applications. Checks to make Back up required business data through approved tools, sign out or revoke sessions, use managed wipe or lock procedures where appropriate, and document custody. Coordinate with the repair provider about data access and restore only after device...

Consultants and partners may use one device for several organizations with different access and data rules. Checks to make Separate identities and work profiles, enforce device and MFA requirements, restrict cross-organization data movement, and define support and incident ownership. Review session persistence and remove work access when an engagement...

Inventory transitions can leave devices tied to a former user or active session after reassignment. Checks to make Confirm device serial and current custodian, revoke sessions and credentials tied to the device, use managed lock or wipe controls, and inspect recent access. Correct inventory ownership and verify any replacement device is enrolled...

A replacement phone may retain old sessions on the previous device while the new one lacks required security enrollment. Checks to make Revoke the old device’s sessions and tokens, enroll the replacement through approved management, verify MFA and work profile setup, and confirm business data is not restored to an unmanaged device. Update inventory and...

A personal device used by others may retain work sessions, downloaded files, and notifications outside the employee’s control. Checks to make Use a separate managed work profile where supported, require device lock and MFA, limit local file storage, and sign out of work accounts when access ends. Provide a managed device for tasks involving sensitive...