Key takeaway
For every device, identify its owner, work role, data sensitivity, support status and policies. Secure remote access with strong authentication and configuration, prioritize updates, and define isolation and recovery steps for lost or compromised devices.
Map devices and owners
Work laptops connect from outside the office, while personal devices, contractor equipment and IoT may be missing from inventory. Record their access to email, files, business applications and internal networks. Without an owner, purpose, supported operating system, security agent and update status, it is difficult to apply the right policy.
Work and personal devices
If BYOD is allowed, define which data and apps can be used, screen-lock and update requirements, and how access is revoked after loss.
Servers and unmanaged devices
Track servers, smart watches, printers, point-of-sale terminals, medical imaging and industrial control systems, smart-home devices and 5G routers separately. If an agent cannot be installed, define their network segment, access rules, owner and compensating controls.
Status and lifecycle
Track lost, spare, repair, retired and unsupported devices; review access whenever a device’s status changes.
Apply a baseline set of controls
Select controls to match risk and assign owners. A firewall, antimalware tool or EDR alone does not secure a device and its data; identity, updates, data protection and incident response work together.
Strong authentication
Enable MFA for email, cloud apps, VPN and remote administration. Use role-based access and separate administrator accounts, and promptly revoke access for departing staff and contractors.
Updates and vulnerabilities
Tie operating system, application, VPN and network-device updates to the inventory. Prioritize internet-facing and high-risk assets, and document testing, emergency updates and exception deadlines.
Device protection and filtering
Manage antimalware, antispyware and host firewall policies centrally. Review network firewall rules for source, destination and application. Test email and web filtering, including malicious-site and attachment blocks, against real workflows; approve exceptions with their owners.
Privileges and removable devices
Separate daily accounts from administrator privileges. Set USB and Bluetooth rules for approved use, encryption and data transfer based on device ownership and work needs.
Data controls
Encrypt sensitive data on devices and in transit, and test DLP rules against real data flows. Encryption makes unauthorized access harder but does not by itself address a stolen account or excessive permissions.
Monitoring and investigation
Define who reviews critical endpoint logs, how long they are retained and who receives suspicious-activity alerts. Check the source, scope and last update of threat intelligence; assign time and skills for analysts to search endpoint telemetry and validate indicators in context.
Classify data and scope BYOD access
Classify data by sensitivity and give each role access only to what its work requires. Define in writing which personal devices and apps are allowed and what data and sites they may access; use risk to decide whether sensitive work requires organization-issued devices.
Report incidents and track exceptions
Tell staff whom to notify and how to report a suspicious file, lost device or possible data exposure promptly. Give every approved exception a reason, owner and expiry date so a temporary decision does not silently become permanent policy.
Review printer and IoT configuration
Replace manufacturer-set initial credentials on printers and IoT devices, apply available firmware and security updates, disable unnecessary services and place each device in an appropriate network segment. Compare configuration with the inventory; assign an owner and compensating controls when updates are unavailable.
Secure remote and mobile access
Remote devices connect from homes, travel and public networks. A VPN can protect traffic, but it does not secure a vulnerable device or a phished account. Decide when VPN is needed based on risk and application design. Pair remote access with MFA, updated devices, least privilege and login logging. Test which EDR policies continue without internet or VPN and what happens when connectivity returns.
Verify the user
Require MFA and restrict administrative and remote access separately. Alert on suspicious logins, new devices and privilege changes.
Check device health
Restrict access to sensitive resources from devices without a supported operating system, active security agent, host firewall and required updates.
Test connectivity
Test VPN, direct cloud access and offline agent behavior. Confirm telemetry upload, policy updates and delivery of isolation commands.
Establish an operating routine
Endpoint security does not end with installation. Device owners, IT and security teams need shared routines for inventory, updates, alerts and recovery. Review policies after changes and on a schedule; technical controls alone do not certify compliance, which requires a separate framework assessment and audit evidence.
Register the device
Confirm the owner and purpose, install a supported operating system and agent, apply a baseline configuration and assign a network segment based on sensitivity.
Track patches and health
Find missing updates, disabled agents, firewall changes and expired support. Assign an owner and end date to every temporary exception.
Respond to alerts
Review connections, processes and user context on a suspicious device; define responses requiring approval, isolation authority and communications. Record false alerts and exclusions.
Validate intelligence and threat hunting
Record an intelligence indicator’s source, scope and update date. Do not treat a stale or context-free indicator as an automatic block decision; analysts should validate it against endpoint logs and other evidence, then search the fleet for related activity.
Contain and recover
When needed, isolate the device, close the initial access path, preserve evidence and restore from a clean backup. Verify its agent, updates and access permissions before reconnecting it.
Review the cycle
Review inventory, patch compliance, response time, isolation tests and support needs. Exercise how remote devices behave offline and after connectivity returns.
Manage the Mac fleet explicitly
Include Macs, including developer devices, in the inventory and ownership model. Check supported macOS versions against current Apple and security-product support lists, test updates and set an update schedule. Obtain apps from the App Store or an identified developer’s signed and notarized distribution, limit administrator access, and test backup restoration.
Check cloud and hosted operations
Test routine console administration, audit trails, policy and mass-update delivery, exception reports and notifications. Check local policy behavior when a device disconnects and how updates, telemetry and response commands work after reconnection. Assign separate owners for security alerts and application performance monitoring.
Test backups and complementary integrations
Define backup frequency, search, restore permissions and whether users can restore their own files, then run a recovery test. Separately check which email gateway and file types are covered by attachment sanitization and how network and cloud controls integrate; these are not automatically part of an endpoint product.
Manage configuration drift and automation
Compare the approved baseline with the device inventory, track configuration changes and identify legacy devices that have left support. Test automated updates and response actions within defined policy and approval boundaries, and assign owners to exceptions. Plan workflows and training around the team’s available time and skills.
Frequently asked questions
Answers to common questions about remote and mixed device fleets.
Should every remote worker use a VPN?
It depends on network and application design. A VPN can protect the connection path but does not replace MFA, updated devices, application-level access and monitoring. Define which workflows require VPN.
Do printers and IoT devices need an EDR agent?
Only when the device and vendor support it. If an agent is not available, use inventory, network segmentation, restricted access, updates and monitoring appropriate to the device.
Does DLP replace encryption?
No. DLP can detect and restrict data movement under policy; encryption helps protect data contents. Review access, key management and backups alongside both.
Does a control checklist certify compliance?
No. A checklist helps manage operations, while compliance requires a separate assessment of the applicable standard, scope, documentation and audit evidence.