Sekit CSF · Family
Endpoint Security
24 controls in 8 topics, each seen through the policy, process and technical lenses.
Policy
RCF-0145Configuration baselines6 mappingsApproved security configuration standards are formally defined for all device types used by the companyRCF-0160Device hardening5 mappingsSecurity hardening requirements are formally defined to reduce the attack surface of all company devicesRCF-0163Disk encryption4 mappingsFull disk encryption is formally required on all portable devices and devices that handle sensitive dataRCF-0148EDR/anti-malware5 mappingsThe company formally requires endpoint detection and response or anti-malware protection on all devicesRCF-0166Local admin control5 mappingsThe use of local administrator rights on company devices is formally restricted and requires approvalRCF-0151MDM/MAM4 mappingsMobile devices and applications used for work are formally required to be managed through an approved systemRCF-0154Patch management5 mappingsThe company formally requires that security patches are applied to all systems within defined timeframesRCF-0157Removable media control4 mappingsThe use of removable storage devices such as USB drives is formally restricted to authorised business needs
Process
RCF-0146Configuration baselines7 mappingsDevices are consistently configured to the approved baseline when deployed and after significant changesRCF-0161Device hardening6 mappingsDevices are consistently hardened by disabling unnecessary services and applying approved security settingsRCF-0164Disk encryption4 mappingsDisk encryption is consistently enabled and verified on all devices within scopeRCF-0149EDR/anti-malware5 mappingsEndpoint protection tools are consistently deployed, updated and alerts are investigated promptlyRCF-0167Local admin control5 mappingsLocal administrator access is consistently limited to authorised personnel and reviewed regularlyRCF-0152MDM/MAM4 mappingsMobile device management policies are consistently applied and devices are enrolled before accessing company dataRCF-0155Patch management5 mappingsPatches are consistently applied on schedule and patch status is tracked across all managed endpointsRCF-0158Removable media control4 mappingsRemovable media use is consistently monitored and unauthorised devices are reported and removed
Technical
RCF-0147Configuration baselines4 mappingsTechnical tools automatically assess device configurations against the approved baseline and report deviationsRCF-0162Device hardening4 mappingsTechnical tools apply and enforce hardening configurations automatically across the device estateRCF-0165Disk encryption4 mappingsTechnical controls enforce disk encryption and can verify encryption status across the entire device fleetRCF-0150EDR/anti-malware6 mappingsEDR tools continuously monitor endpoint behaviour and automatically contain threats when detectedRCF-0168Local admin control4 mappingsTechnical controls prevent users from running with local administrator privileges without approvalRCF-0153MDM/MAM4 mappingsTechnical MDM controls enforce security policies on mobile devices and can remotely wipe lost or stolen devicesRCF-0156Patch management4 mappingsTechnical tools automate patch deployment and report on outstanding patches by age and severityRCF-0159Removable media control4 mappingsTechnical controls block or restrict the use of removable storage devices at the operating system level
This family in ISO/IEC 27001:2022
Every framework item the family's controls map to, most-connected first — grouped by Sekit CSF family, never by the framework's own index.
This family in NIST CSF 2.0
This family in Cyber Essentials
Ask Sekura: “What evidence proves Endpoint Security?”
Also via MCP, free with account