User end point devices

Plain-language summary

Protecting the information that sits on, passes through or can be reached from laptops, desktops, phones and tablets — company-issued or personally owned — so that a lost device, an unlocked screen or an unmanaged phone does not become the route into your data.

What the clause is really asking

Endpoints are where people work, so they are where information leaks and attackers land. The control asks you to protect that information; the guidance frames this as a topic-specific policy on endpoint devices plus the technical settings to back it up: devices registered and managed; full-disk encryption; screen lock and automatic timeout; operating system and application updates; malware protection; restrictions on installing software; rules for public networks and removable media; backup of anything stored locally; and the ability to lock or wipe a device remotely. It also covers what users must do — lock the screen when stepping away, keep the device with them in transit, report a loss immediately. The 2022 version folds the old mobile-device and unattended-equipment controls together and explicitly covers personal devices: if staff read work email on their own phones, you need rules for separating business data from personal data, and a signed agreement on what you may do to that device. The common misunderstanding is treating this as a laptop-only control; a lost phone with an open mail app can be a POPIA section 22 notification.

What auditors look for

Auditors compare the device inventory or management console against the HR headcount and ask about the gap: who has a device that is not enrolled? They pick a sample of laptops and check encryption status, patch level, screen-lock timeout and local admin rights in the console, then ask a user to show them a phone that receives company email. They ask what happens when a laptop is stolen — walk me through the last one — and look for the remote-wipe record and the incident entry. For personal devices they ask for the signed BYOD agreement and how company data is separated and removed when the person leaves.

Typical evidence

Endpoint device policy including personal-device rules; device inventory or mobile device management console export; encryption, patching and screen-lock compliance reports; standard endpoint build or configuration profile; signed BYOD agreements; records of lost or stolen devices with remote lock or wipe actions; leaver records showing devices returned and company data removed.

How to comply — recommendations

Write a two-page endpoint policy covering company and personal devices, then enforce it in a management tool rather than relying on people reading it — Microsoft Intune, Google endpoint management or your MSP's platform. Set the minimum baseline: encryption on, screen lock at five minutes or less, automatic updates, endpoint protection running, no local admin for ordinary users. For phones, use app protection so company email and files sit in a managed container you can wipe without touching personal photos, and get a signed BYOD agreement before access is granted. Reconcile the device list to HR monthly. Make 'report a lost device within an hour' part of induction, and keep the lock-and-wipe record each time.

Common nonconformities

Devices in use that are not enrolled or not in the inventory; laptops without full-disk encryption; users with local administrator rights by default; no remote wipe capability for phones holding company email; personal devices accessing company data with no agreement or separation; screen-lock settings not enforced; lost devices never reported or not treated as incidents.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.