ISO 27001 A.8.1: laptops and phones, explained for startups
What A.8.1 asks of a small company, and what an auditor samples.
Protect the laptops, phones, and other devices people use to reach company data. Endpoints are a common way in for attackers, so they need real safeguards.
Why it exists: to keep company laptops and phones managed, patched and protected.
A.8.1 User end point devices
Company laptops and phones are managed and protected. What proves it: every company device enrolled in device management, with encryption and the required settings on.
A certification auditor samples device management export. A file that usually does the job: an export from your device management tool listing every device with its encryption and screen lock status.
How to put it in place
Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.8.1 walks you through it in this order.
- Enroll every company device in device management.
- Enforce encryption, screen lock and updates.
- Export the compliance report and fix any device that fails.
The free ISO 27001 readiness assessment asks one question that evidences it:
- Are laptops managed by a mobile device management (MDM) tool that enforces disk encryption, screen lock, updates, malware protection and remote wipe?
Policies, connectors and the SOC 2 overlap
In the ISO 27001 policy pack, the Acceptable Use Policy covers A.8.1. An auditor reads the policy for the rule, then samples the records to see the rule was followed.
Connected systems that pull evidence for it:
- Microsoft Entra ID, Intune managed devices: devices managed in Intune, with their encryption and compliance state.
The same evidence counts toward SOC 2. The Trust Services criteria that cover this ground: CC6.1, logical access and CC6.8, malware prevention.
Technological controls
A.8.1 is one of the 34 technological controls in Annex A. The controls built into your systems: access, devices, malware, vulnerabilities, backups, logging, networks, encryption and secure development. Exports and settings screenshots prove most of them.
Nearby controls in the same theme:
Before it: A.7.14, disposing of equipment. After it: A.8.2, privileged access. Every control, by theme, is on the Annex A controls page.
Questions
What does ISO 27001 A.8.1 require?
What evidence does an auditor want for A.8.1?
Get ready for ISO 27001 certification.
The readiness assessment is free, with no payment and no card. ISO 27001 is part of Constellation, at $10,800 a year: everything in Orbit plus the management system, the policies, the evidence and the management review for ISO 27001, and your SOC 2 Type 2 audit is included in every contract year. You contract the certification body directly.
The internal audit is priced separately: Polara arranges it with an independent internal auditor from our partner network who works in the platform, and quotes it for your company.
Take the free assessmentPolara Labs is not a certification body. Certification audits are performed by independent accredited certification bodies.