A.8.1 Audit Checklist

When to use this

Use this checklist during an internal audit of user endpoint device protection.

Related controls

• A.8.1 User End Point Devices
• A.8.1 Audit Evidence Pack
• Endpoint Device Security Standard
• Endpoint Device Inventory and Compliance Register
• Endpoint Loss or Theft Response Checklist
• Remote Access and Endpoint Connection Checklist

Audit checklist

• Review endpoint policy and device security standard.
• Confirm endpoint inventory includes corporate and BYOD devices.
• Sample endpoint compliance reports.
• Check patch, malware/EDR, encryption, and screen lock evidence.
• Review remote access controls.
• Check session timeout settings.
• Review local storage and cloud backup rules.
• Check loss/theft response process.
• Interview users on device responsibilities.

Findings table