Scope Enterprise Active

Endpoint Security

To protect endpoint devices (laptops, servers, mobile) from threats.

Domain ID
DOM-011
Domain Code
END
Business Owner
Endpoint Security

Domain Overview

END · Full Domain Profile
Short Overview

Establishes the processes for securing endpoint devices including desktops, laptops, servers, and mobile devices against security threats.

Description

Encompasses the security of all endpoint devices, including endpoint protection, detection and response (EDR), and mobile device management (MDM).

Why This Domain Matters

Remote and hybrid work has expanded the endpoint attack surface, making consistent endpoint security management across diverse locations and devices increasingly difficult.

Business Objectives

    Business Risks

      Common Challenges

        Key Capabilities

        Stakeholders, Industries & Technologies

        END · Operating Context

        Typical Stakeholders

        Applicable Industries

        Applicable Technologies

        Keywords & Tags

        Associated Controls Catalog

        6 Active Controls in Domain
        Control ID Control Name Category & Type Criticality Status Requirements Action
        END-001 Endpoint Protection Establishes comprehensive endpoint prote...
        Technical
        Detective
        		 Critical Active 📋 10 Reqs View →
        END-002 Endpoint Detection & Response (EDR) Establishes Endpoint Detection and Respo...
        Technical
        Corrective
        		 Critical Active 📋 10 Reqs View →
        END-003 Mobile Device & Application Management Establishes mobile device and applicatio...
        Technical
        Detective
        		 High Active 📋 10 Reqs View →
        END-004 Endpoint Encryption Establishes endpoint encryption includin...
        Technical
        Corrective
        		 Critical Active 📋 10 Reqs View →
        END-005 Endpoint Application Control Establishes endpoint application control...
        Technical
        Detective
        		 High Active 📋 10 Reqs View →
        END-006 Removable Media & Peripheral Control Establishes controls for removable media...
        Technical
        Detective
        		 High Active 📋 10 Reqs View →

        Compliance Requirements & Audit Crosswalk

        60 Specific Audit Clauses

        The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.

        REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
        END-001-R001 Endpoint Protection Policy The organization shall establish an endp... END-001 Endpoint Protection Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-001-R002 Endpoint Protection Deployment The organization shall deploy endpoint p... END-001 Endpoint Protection Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-001-R003 Malware Prevention The organization shall implement malware... END-001 Endpoint Protection Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-001-R004 Threat Prevention Configuration The organization shall configure endpoin... END-001 Endpoint Protection Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-001-R005 Endpoint Protection Monitoring The organization shall monitor endpoint... END-001 Endpoint Protection Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-001-R006 Threat Detection Validation The organization shall validate endpoint... END-001 Endpoint Protection Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-001-R007 Protection Reporting The organization shall report on endpoin... END-001 Endpoint Protection Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-001-R008 Protection Review The organization shall conduct periodic... END-001 Endpoint Protection Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-001-R009 Exception Management The organization shall manage exceptions... END-001 Endpoint Protection Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-001-R010 Protection Continuous Improvement The organization shall drive ongoing enh... END-001 Endpoint Protection Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-002-R001 EDR Framework The organization shall establish an Endp... END-002 Endpoint Detection & Response... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-002-R002 Endpoint Telemetry Collection The organization shall collect comprehen... END-002 Endpoint Detection & Response... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-002-R003 Threat Detection The organization shall implement threat... END-002 Endpoint Detection & Response... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-002-R004 Threat Investigation The organization shall investigate endpo... END-002 Endpoint Detection & Response... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-002-R005 Endpoint Response The organization shall respond to endpoi... END-002 Endpoint Detection & Response... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-002-R006 Threat Hunting The organization shall establish proacti... END-002 Endpoint Detection & Response... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-002-R007 EDR Monitoring The organization shall monitor EDR activ... END-002 Endpoint Detection & Response... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-002-R008 EDR Reporting The organization shall report on EDR, pr... END-002 Endpoint Detection & Response... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-002-R009 EDR Review The organization shall conduct periodic... END-002 Endpoint Detection & Response... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-002-R010 EDR Continuous Improvement The organization shall drive ongoing enh... END-002 Endpoint Detection & Response... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-003-R001 Mobile Security Framework The organization shall establish a mobil... END-003 Mobile Device & Application Ma... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-003-R002 Device Enrollment The organization shall enroll mobile dev... END-003 Mobile Device & Application Ma... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-003-R003 Device Configuration Management The organization shall configure mobile... END-003 Mobile Device & Application Ma... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-003-R004 Mobile Application Management The organization shall manage mobile app... END-003 Mobile Device & Application Ma... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-003-R005 Corporate Data Protection The organization shall protect corporate... END-003 Mobile Device & Application Ma... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-003-R006 Mobile Compliance Monitoring The organization shall monitor mobile de... END-003 Mobile Device & Application Ma... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-003-R007 Mobile Incident Management The organization shall manage security i... END-003 Mobile Device & Application Ma... Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-003-R008 Mobile Reporting The organization shall report on mobile... END-003 Mobile Device & Application Ma... Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-003-R009 Mobile Review The organization shall conduct periodic... END-003 Mobile Device & Application Ma... Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-003-R010 Mobile Continuous Improvement The organization shall drive ongoing enh... END-003 Mobile Device & Application Ma... Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-004-R001 Endpoint Encryption Framework The organization shall establish an endp... END-004 Endpoint Encryption Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-004-R002 Encryption Requirements The organization shall define encryption... END-004 Endpoint Encryption Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-004-R003 Encryption Deployment The organization shall deploy encryption... END-004 Endpoint Encryption Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-004-R004 Encryption Key Management Integration The organization shall integrate endpoin... END-004 Endpoint Encryption Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-004-R005 Encryption Status Monitoring The organization shall monitor endpoint... END-004 Endpoint Encryption Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-004-R006 Encryption Exception Management The organization shall manage exceptions... END-004 Endpoint Encryption Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-004-R007 Encryption Reporting The organization shall report on endpoin... END-004 Endpoint Encryption Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-004-R008 Encryption Review The organization shall conduct periodic... END-004 Endpoint Encryption Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-004-R009 Recovery Management The organization shall recover encrypted... END-004 Endpoint Encryption Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-004-R010 Encryption Continuous Improvement The organization shall drive ongoing enh... END-004 Endpoint Encryption Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-005-R001 Application Control Framework The organization shall establish an endp... END-005 Endpoint Application Control Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-005-R002 Approved Application Management The organization shall maintain an appro... END-005 Endpoint Application Control Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-005-R003 Application Allowlisting The organization shall implement applica... END-005 Endpoint Application Control Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-005-R004 Application Execution Control The organization shall control the execu... END-005 Endpoint Application Control Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-005-R005 Application Exception Management The organization shall manage exceptions... END-005 Endpoint Application Control Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-005-R006 Application Monitoring The organization shall monitor applicati... END-005 Endpoint Application Control Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-005-R007 Application Compliance Reporting The organization shall report on applica... END-005 Endpoint Application Control Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-005-R008 Application Review The organization shall conduct periodic... END-005 Endpoint Application Control Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-005-R009 Unauthorized Application Detection The organization shall detect unauthoriz... END-005 Endpoint Application Control Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-005-R010 Application Control Continuous Improvement The organization shall drive ongoing enh... END-005 Endpoint Application Control Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-006-R001 Removable Media Framework The organization shall establish a remov... END-006 Removable Media & Peripheral C... Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-006-R002 Device Authorization The organization shall authorize removab... END-006 Removable Media & Peripheral C... Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-006-R003 Peripheral Access Control The organization shall control access to... END-006 Removable Media & Peripheral C... Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-006-R004 Media Usage Restrictions The organization shall implement restric... END-006 Removable Media & Peripheral C... Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-006-R005 Media Activity Monitoring The organization shall monitor removable... END-006 Removable Media & Peripheral C... Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-006-R006 Exception Management The organization shall manage exceptions... END-006 Removable Media & Peripheral C... Endpoint Security, IT Operations, Security Operations, CISO View ↗
        END-006-R007 Media Audit Logging The organization shall maintain comprehe... END-006 Removable Media & Peripheral C... Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-006-R008 Media Reporting The organization shall report on removab... END-006 Removable Media & Peripheral C... Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-006-R009 Media Review The organization shall conduct periodic... END-006 Removable Media & Peripheral C... Endpoint Security / IT Operations, Security Operations, CISO View ↗
        END-006-R010 Media Continuous Improvement The organization shall drive ongoing enh... END-006 Removable Media & Peripheral C... Endpoint Security / IT Operations, Security Operations, CISO View ↗

        Cross-Mapped Regulatory Frameworks

        Harmonized Control Mappings
        Framework Code Framework Name & Description Family / Category Version Action
        NIST80053 NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control f...
        NIST
        Control Catalog
        		 vRev. 5 View →
        NIST-CSF NIST CSF (PR.AC) The NIST Cybersecurity Framework provide...
        NIST
        Framework
        		 v2 View →
        MAPPED ISO 27001 (Clause A.12) Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        PCI-DSS PCI DSS PCI DSS is an industry security standard...
        PCI
        Standard
        		 v4 View →
        GDPR GDPR The General Data Protection Regulation i...
        EU
        Regulation
        		 vCurrent View →
        HIPAA HIPAA HIPAA is a U.S. federal law supported by...
        US
        Law
        		 vCurrent View →
        COBIT2019 COBIT (APO13) COBIT is an enterprise governance and ma...
        COBIT
        Governance Framework
        		 v2019 View →