Key takeaway
Define the data and remote-work scenarios first, then test for gaps across EDR, ZTNA, DLP, MFA and cloud sharing.
EDR: endpoint detection and response
An agent on a supported device may continue local protection and buffer records until connectivity returns. Cloud telemetry and remote isolation require device reachability; isolation of a lost or offline device may be unavailable until connectivity returns. Check OS support, alert owners, isolation authority and investigation-record storage. Rehearse separate responses for reachable and offline devices.
ZTNA: access only to required apps
Grant access to specific applications based on user and device state instead of treating a broad network zone as trusted. Define which policy blocks access after a role change or device-compliance failure. Use additional checks and separate permissions for administrators and critical apps. ZTNA defines application-access boundaries, while MFA verifies identity at sign-in. Test in-app authorization and whether session revocation actually removes access.
DLP: data egress paths
DLP policies can track classified data in email, browser uploads, synchronization, printing and USB storage. Decide in advance what is blocked, alerted on or sent for manager approval. Test content examples and exceptions with a pilot group so normal work can continue. Require demonstrations of supported channels, browsers, apps and file types using synthetic samples.
MFA and identity management
Centralize permissions for users, groups, devices and applications. Require MFA especially for administrators, new-device enrollment and applications holding sensitive data. Assign ownership and review emergency accounts and recovery methods; test MFA at both the application and identity-provider layers. Prefer phishing-resistant MFA where supported; not every MFA method has that property.
Encrypted backups and file sharing
For backups, assess coverage, encryption, retention, protection from deletion and a recovery test. In file sharing, govern link lifetime, recipient domains, downloads and access records. For sensitive data, review the provider’s key model and administrator access to keys. Restore a sample backup with usable keys and verify that files open; test sharing and download restrictions separately.
Additional security categories
A secure web gateway inspects traffic while DNS filtering inspects domain lookups; both can block known phishing and malicious domains. Full URL paths and content may require broader web-layer controls. A CASB enforces policy across SaaS and cloud apps; MDR adds analyst investigation and response coverage on top of automated tools. A password manager helps manage unique credentials. Evaluate these capabilities against the apps in use and actual response duties.
Daily practice and vendor selection
Extend MFA beyond email to cloud storage and administrator consoles. Deploy operating-system and application patches centrally, grant minimum role-based access, run recurring phishing training and review third-party app permissions. On public Wi-Fi, use an approved secure connection for each application and check full-disk encryption. ZTNA may cover only selected private applications and does not automatically tunnel all device traffic. Ask vendors to demonstrate remote management, scaling, threat-intelligence updates, support and incident response.
Choose the workflow, not the label
Evaluate EDR, ZTNA, DLP, MFA, CASB, web filtering and backup in an end-to-end scenario: detect a suspicious sign-in, revoke the session, isolate the device, stop file sharing and restore data. Compare integrations, remote management, scaling, alert ownership, threat-intelligence updates, support and response terms against test results. Use synthetic data, document offline limits and compare response duties with the contract.
Define the sample and owner
Choose synthetic data, an app and a device; name business and response owners and record the allowed workflow.
Test suspicious sign-in
Trigger a sign-in alert in an authorized test; the owner revokes the test session and verifies application access stops.
Contain the device and sharing
Test authorized isolation of a reachable device and sharing restrictions; record actions unavailable while offline.
Verify recovery
Restore files and access and test the workflow; record gaps, remediation owners and the acceptance decision.