Authentication, least privilege, access reviews and identity lifecycle controls.
A device policy may report success while encryption is incomplete, suspended, or missing a recoverable key. Checks to make Use the platform’s authoritative encryption state, confirm coverage for system and removable volumes as required, verify recovery-key escrow, and check policy compliance timestamps. Test reporting on representative device types and...
Standing local administrator rights increase the impact of malicious software and accidental changes. Checks to make Inventory who has local admin rights and why, remove unnecessary standing access, and provide a controlled elevation path for approved tasks. Test common workflows first and monitor elevation events so business needs are addressed...
A lost device away from the office may contain cached data, active sessions, and access tokens. Checks to make Confirm device identity and last known location through a trusted channel, report it promptly, revoke sessions, and use approved lock or wipe controls. Review sign-in activity and data sensitivity, then document recovery or replacement steps....
Repeated compliance failures can come from stale inventory, policy mismatch, unsupported OS, or a device that has not checked in. Checks to make Compare device identity and last check-in with assigned policy, inspect the failing control and platform version, and verify management connectivity. Separate genuine noncompliance from reporting delay before...
A device can go silent because of network access, expired enrollment, a broken agent, or a device that has been retired without inventory cleanup. Checks to make Compare last check-in, device ownership, agent health, enrollment state, and connectivity. Verify the device is still in service before remediation, and distinguish stale records from active...
Repeated failures can result from unsupported software, management enrollment problems, or a genuine control gap. Checks to make Review the exact failing policy and device status, confirm check-in and ownership, and guide the user through approved remediation. Provide a time-bound exception only through the risk process and verify compliance after the...
Mobile email can expose business data through unmanaged devices, weak screen locks, local downloads, or stale sessions. Checks to make Set device enrollment and encryption requirements, require screen lock and MFA, control local data and copy behavior where supported, and define lost-device response. Test access removal and selective wipe so personal...
Shared devices blur user attribution and can retain data or sessions between employees. Checks to make Use named sign-ins where possible, set automatic session lock and clear user data between shifts, restrict local admin access, and verify logs identify the individual. Document approved shared-device workflows and review exceptions. When to get help...