OPS-04 · Secure Operations
Endpoint and device protection
Devices with access to organizational data are hardened, patched, encrypted and recoverable.
5frameworks fully address it
1partially
2leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC6.8
- ISO 27001FullA.8.1
- NIST CSFFullPR.PS-01
- PCI DSSFull5.2
- HIPAAFull164.310(c)
- GDPRPartialArt. 32(1)(a) Encryption named as an example measure.
- EU AI ActAbsent Not addressed.
- NIST AI RMFAbsent Not addressed at control level.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Device inventory, configuration baseline, encryption evidence.
?Why it exists
The laptop is the office.
For a smaller organizationMDM or a documented baseline with proof for each device.