SAMMY UI is optimized for resolutions with a width 1024px and higher.
Cloud Controls Matrix
Browse Cloud Controls...
UEM-01: Endpoint Devices Policy and Procedures
Endpoint Devices Policy and Procedures
UEM-01: Are policies and procedures established, documented, approved, communicated, applied, evaluated, and maintained for all endpoints?

Policies and procedures for both managed and unmanaged endpoints (including BYOD) should include the following components:
a. Definition of endpoints and the acceptable-use policy requirements for all endpoints (mobile devices, virtual, desktop, etc.). Note: Physical and virtual servers, containers, and similar "endpoints" are addressed in the DCS and IVS domains, while application and interface "endpoints" are discussed in the AIS domain.
b. List the approved systems, servers, applications, application stores, application extensions, and plugins that may be allowed for managed endpoint access and usage and/or enforced through enterprise management tools.
c. Policy and procedures related to installing non-approved applications or approved applications not obtained through a pre-identified application store.
d. Prohibit the circumvention of vendor-supported and integrated (built-in) security controls on endpoints (i.e., jailbreaking or rooting). Enforce these restrictions through detective and preventive controls on the endpoint, managed through a centralized system (e.g., an endpoint, system configuration control, or mobile device management system).
e. Policies regarding privacy expectations and requirements for remote location identification, litigation, e-discovery, and legal holds (especially for personally-owned devices).
f. Policies and procedures related to non-company data loss if a full or partial wipe of a device is required.
g. Performing policy reviews at planned intervals or upon significant organizational or environmental changes.

Policies and procedures should also integrate the following concepts (which may have applicable controls in other domains to consider):
h. Passcodes, biometric authentication, idle/no-use screen locks, and logouts.
i. The use of anti-malware software.
j. The use of encryption for the entire device or data identified as non-public on all endpoints (enforced through technology controls).
k. Each endpoint device should be assigned to a named person who is responsible for it. Such devices may be shared (e.g., in shared work areas), but a single individual should still be assigned responsibility for it.
l. Non-device endpoints should also have "owners" responsible for assessing risks and ensuring appropriate controls.
m. Endpoints should be vetted for policy compliance before being provisioned for organizational use.
Control implemented
Not applicable - A “N/A” answer indicates that the portion of the control in question is out of scope of the assessment. The “SSRM control ownership” column is to be left blank (e.g., greyed out), and optionally the CSP may explain why it is the case (“CSP Implementation Description”).
No - A “No” answer indicates that the portion of the control in question is not implemented, while in scope of the assessment. The CSP has to assign the implementation responsibility of the control to the relevant party under column “SSRM control ownership”, and optionally elaborate on the “why” (has not been implemented), and “what” has to be done for its implementation by that party.
Yes - A “Yes” answer indicates that the portion of the control in question is implemented. The CSP indicates the responsible and accountable parties (SSRM control ownership), and optionally elaborates on the implementation “how-to” per relevant party CSP and/or CSC.
Control ownership
CSP-owned - The CSP is entirely responsible and accountable for the CCM control implementation.
CSC-owned - The Cloud Service Customer (CSC) is entirely responsible and accountable for the CCM control implementation.
Third-party - The third-party CSP in the supply chain (e.g., an IaaS provider) is responsible for CCM control implementation, while the CSP is fully accountable.
Shared CSP and CSC - Both the CSP and CSC share CCM control implementation responsibility and accountability.
Shared CSP and third party - Any CCM control implementation responsibility is shared between CSP and the third party, but the CSP remains fully accountable.
Description

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for all endpoints. Review and update the policies and procedures at least annually.

Endpoint Devices Policy and Procedures
UEM-01: Are universal endpoint management policies and procedures reviewed and updated at least annually?

Policies and procedures for both managed and unmanaged endpoints (including BYOD) should include the following components:
a. Definition of endpoints and the acceptable-use policy requirements for all endpoints (mobile devices, virtual, desktop, etc.). Note: Physical and virtual servers, containers, and similar "endpoints" are addressed in the DCS and IVS domains, while application and interface "endpoints" are discussed in the AIS domain.
b. List the approved systems, servers, applications, application stores, application extensions, and plugins that may be allowed for managed endpoint access and usage and/or enforced through enterprise management tools.
c. Policy and procedures related to installing non-approved applications or approved applications not obtained through a pre-identified application store.
d. Prohibit the circumvention of vendor-supported and integrated (built-in) security controls on endpoints (i.e., jailbreaking or rooting). Enforce these restrictions through detective and preventive controls on the endpoint, managed through a centralized system (e.g., an endpoint, system configuration control, or mobile device management system).
e. Policies regarding privacy expectations and requirements for remote location identification, litigation, e-discovery, and legal holds (especially for personally-owned devices).
f. Policies and procedures related to non-company data loss if a full or partial wipe of a device is required.
g. Performing policy reviews at planned intervals or upon significant organizational or environmental changes.

Policies and procedures should also integrate the following concepts (which may have applicable controls in other domains to consider):
h. Passcodes, biometric authentication, idle/no-use screen locks, and logouts.
i. The use of anti-malware software.
j. The use of encryption for the entire device or data identified as non-public on all endpoints (enforced through technology controls).
k. Each endpoint device should be assigned to a named person who is responsible for it. Such devices may be shared (e.g., in shared work areas), but a single individual should still be assigned responsibility for it.
l. Non-device endpoints should also have "owners" responsible for assessing risks and ensuring appropriate controls.
m. Endpoints should be vetted for policy compliance before being provisioned for organizational use.
Control implemented
Not applicable - A “N/A” answer indicates that the portion of the control in question is out of scope of the assessment. The “SSRM control ownership” column is to be left blank (e.g., greyed out), and optionally the CSP may explain why it is the case (“CSP Implementation Description”).
No - A “No” answer indicates that the portion of the control in question is not implemented, while in scope of the assessment. The CSP has to assign the implementation responsibility of the control to the relevant party under column “SSRM control ownership”, and optionally elaborate on the “why” (has not been implemented), and “what” has to be done for its implementation by that party.
Yes - A “Yes” answer indicates that the portion of the control in question is implemented. The CSP indicates the responsible and accountable parties (SSRM control ownership), and optionally elaborates on the implementation “how-to” per relevant party CSP and/or CSC.
Control ownership
CSP-owned - The CSP is entirely responsible and accountable for the CCM control implementation.
CSC-owned - The Cloud Service Customer (CSC) is entirely responsible and accountable for the CCM control implementation.
Third-party - The third-party CSP in the supply chain (e.g., an IaaS provider) is responsible for CCM control implementation, while the CSP is fully accountable.
Shared CSP and CSC - Both the CSP and CSC share CCM control implementation responsibility and accountability.
Shared CSP and third party - Any CCM control implementation responsibility is shared between CSP and the third party, but the CSP remains fully accountable.
Description

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for all endpoints. Review and update the policies and procedures at least annually.