Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Learn more about the connected frameworks

10.1.1
ISO27 Full

Policy on the use of cryptographic controls

11.2.6
ISO27 Full

Security of equipment and assets off-premises

11.2.8
ISO27 Full

Unattended user equipment

12.6.2
ISO27 Full

Restrictions on software installation

3.1.4
TISAX

Management of IT and mobile data storage devices

5.10
ISO27k1 Full

Acceptable use of information and other associated assets

6.10
Tietoturvasuunnitelma

Työasemien, mobiililaitteiden ja käyttöympäristön tukipalveluiden hallinta

6.2.1
ISO27 Full

Mobile device policy

6.6.4
Self-monitoring

Fyysisten tilojen, laitteiden ja tulosteiden turvallisuus

7.9
ISO27k1 Full

Security of assets off-premises

8.1
ISO27k1 Full

User endpoint devices

CC6.8
SOC 2

Detection and prevention of unauthorized or malicious software

DE.CM-5
NIST

Unauthorized mobile code detection

DE.CM-5
CyFun

Unauthorized mobile code is detected.

FYY-04
Julkri

Tiedon säilytys

SUM-01
Cyber Essentials

Managing licensed software

TEK-18.1
Julkri

Etäkäyttö - tietojen ja tietoliikenteen salaaminen

Other tasks from the same security theme

Personnel guidelines for safe usage of mobile devices

Critical
High
Normal
Low

There are separate instructions for staff to use mobile devices. The instructions cover:

  • restrictions on installing software and using various services on your organization's devices
  • procedures for the registration of new devices
  • requirements for physical protection of equipment and installation of updates
  • access control requirements
  • protecting your organization’s data with encryption, malware protection, and backup
  • the ability of the organization to remotely control the device
11.2.6: Security of equipment and assets off-premises
ISO27 Full
6.2.1: Mobile device policy
ISO27 Full
10.1.1: Policy on the use of cryptographic controls
ISO27 Full
11.2.8: Unattended user equipment
ISO27 Full
12.6.2: Restrictions on software installation
ISO27 Full

Process for theft / disappearance of mobile equipment

Critical
High
Normal
Low

Procedures have been established for the theft or loss of mobile devices.

The user may be required to e.g.:

  • change network access codes
  • report the situation to the IT department (and, if necessary, to the police or mobile access provider)
  • change any other credentials that may have been compromised

The organizational process in the event of a device loss may include e.g. clearing the device (at least the contents of the organization) remotely.

6.2.1: Mobile device policy
ISO27 Full
6.6.4: Fyysisten tilojen, laitteiden ja tulosteiden turvallisuus
Self-monitoring
8.1: User endpoint devices
ISO27k1 Full
CC6.7: Restriction and protection of information in transmission, movement or removal
SOC 2

Safe disposal of laptops

Critical
High
Normal
Low

The organization has defined procedures for the safe disposal of laptops that are no longer required.

8.3.2: Disposal of media
ISO27 Full
11.2.7: Secure disposal or re-use of equipment
ISO27 Full
PR.DS-3: Asset management
NIST
TEK-21: Sähköisessä muodossa olevien tietojen tuhoaminen
Julkri
7.10: Storage media
ISO27k1 Full

Procedure for identifying software licensing requirements

Critical
High
Normal
Low

Installing commercially licensed software can cause a breach of the licence terms for the software. Organisation should have a procedure for identifying licensing requirements for before permitting any licensed software to be installed.

Particular attention should be paid to cases where the data system is elastic and scalable and can be run on more systems or processor cores than is permitted by the licence terms.

18.1: Compliance with legal and contractual requirements
ISO 27017
18.1.2: Intellectual property rights
ISO 27017
18.1.2: Intellectual property rights
ISO27 Full
18: Compliance
ISO 27017
5.32: Intellectual property rights
ISO27k1 Full

Third-party endpoint security monitoring

Critical
High
Normal
Low

The organization must have policies defined for monitoring the security of third party endpoint devices. Policies may include both technical and contractual practices.

In general, the organization must carefully consider the situation before granting access to the organization's data to third parties and their endpoint devices.

No items found.

Enabling remote wipe on endpoint devices

Critical
High
Normal
Low

The organization must enable remote wiping on all mobile devices it manages (e.g., phones, laptops, tablets).

Remote wiping can help protect your device and the data it contains in the event of loss or theft. However, remote wiping must be used with extreme caution.

7.9: Security of assets off-premises
ISO27k1 Full

Enabling remote locating on endpoint devices

Critical
High
Normal
Low

The organization must enable remote locating on all mobile endpoints managed by the organization (e.g., phones, laptops, tablets).

Remote locating helps protect your device and the information it contains in the event of loss or theft.

No items found.

Software firewall on endpoint devices

Critical
High
Normal
Low

All endpoint devices in the organization should be protected by a properly configured software firewall that monitors traffic, accepts compliant traffic, and monitors users.

A firewall protects against malware and attacks that come from inside or outside your organization's network.

FWL-03: Host based firewall protection
Cyber Essentials
ARCHITECTURE-3: Implement IT and OT Asset Security as an Element of the Cybersecurity Architecture
C2M2: MIL1
DE.CM-1: The network is monitored to detect potential cybersecurity events.
CyFun

Process for testing the compatibility of endpoints

Critical
High
Normal
Low

Poorly configured endpoints cause both a waste of resources but also potential security problems.

The organization shall define a process to identify potential compatibility issues between the endpoint devices used and the operating systems, information systems or applications.

No items found.

Listing and monitoring allowed applications on endpoints

Critical
High
Normal
Low

The organization must have list of approved applications, and application sources, that are allowed to be used on the organization's endpoint devices.

The organization should, if possible, execute management of approved software using automation for example with policies from mobile device management system.

MWP-05: Whitelisting
Cyber Essentials
MWP: Application allow listing
Cyber Essentials
ARCHITECTURE-3: Implement IT and OT Asset Security as an Element of the Cybersecurity Architecture
C2M2: MIL1
DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events.
CyFun
2.3.2: Configure clients so that only software known to the organisation is able to execute
NSM ICT-SP

Mobile device security policies and their monitoring

Critical
High
Normal
Low

The security policies defined in the mobile device management system aim to protect the organization’s data. For example, to reduce the risk of losing devices, you can specify that the device be locked after 5 minutes of inactivity or that the device be completely wiped after 3 failed login attempts.

It may make sense to test new policies first with a small group of users. Policies also require oversight. You can initially select a setting for policies that informs the administrator of settings that violate the policy, but does not completely block access.

6.2.1: Mobile device policy
ISO27 Full
8.1: User endpoint devices
ISO27k1 Full
CC6.7: Restriction and protection of information in transmission, movement or removal
SOC 2
6.10: Työasemien, mobiililaitteiden ja käyttöympäristön tukipalveluiden hallinta
Tietoturvasuunnitelma
3.1.4: Management of IT and mobile data storage devices
TISAX

Using a mobile device management system

Critical
High
Normal
Low

Mobile Device Management (MDM) helps secure and manage staff mobile devices, whether they are iPhones, iPads, Android devices, or Windows devices. E.g. a Microsoft 365 subscription includes the basics of mobile device management.

Mobile device management system can be used to e.g. configure device security policies, wipe remotely and get accurate device usage reporting.

6.2.1: Mobile device policy
ISO27 Full
8.1: User endpoint devices
ISO27k1 Full
CC6.7: Restriction and protection of information in transmission, movement or removal
SOC 2
3.1.4: Management of IT and mobile data storage devices
TISAX
DE.CM-5: Unauthorized mobile code is detected.
CyFun

Endpoint PIN-protection and automated locking

Critical
High
Normal
Low

Devices should be protected against unauthorized access to or disclosure of information stored on or processed by them. Mandatory protection of the devices, e.g. with a 5-digit PIN code before each use, and automatic locking of the devices, e.g. after 5 minutes of inactivity, can help.

11.2.9: Clear desk and clear screen policy
ISO27 Full
6.6.4: Fyysisten tilojen, laitteiden ja tulosteiden turvallisuus
Self-monitoring
7.7: Clear desk and clear screen
ISO27k1 Full
SEC-06: Reviewing password practices on password protected systems
Cyber Essentials

Endpoint security management system

Critical
High
Normal
Low

Endpoint security management system can be used to demand the desired security criteria from the devices before they are allowed to connect to the network resources. Devices can be laptops, smartphones, tablets or industry-specific hardware.

Criteria for the use of network resources may include e.g. approved operating system, VPN and antivirus systems, and the timeliness of these updates.

13.1.1: Network controls
ISO27 Full
6.2.1: Mobile device policy
ISO27 Full
PR.PT-4: Communications and control networks
NIST
HAL-19: Tietojen käsittely
Julkri
8.1: User endpoint devices
ISO27k1 Full

Device list maintenance in a mobile device management system

Critical
High
Normal
Low

The devices must be registered in the mobile device management system in order to obtain a unique identifier for the device and to use the management features. When purchasing new devices, the devices are always registered in the mobile device management system.

8.1.1: Inventory of assets
ISO27 Full
1.2.1: Establish a process to identify devices and software in use at the organisation
NSM ICT-SP
1.2.3: Identify devices in use at the organisation
NSM ICT-SP