Security & Compliance Standards for End-User Devices

1. Purpose

This document defines the minimum security and compliance requirements for all end-user devices listed in the hardware catalog. It also identifies which device classes meet each tier of usage restriction. All devices in this catalog must meet at least the Tier 1 baseline. Devices used in regulated or restricted-handling contexts must meet additional tier requirements as defined in Section 4.

2. Security Tier Model

3. Tier 1 Baseline Requirements

Every catalog device must meet the following requirements at the time of issuance and continuously through its lifecycle:

• Hardware Root of Trust — TPM 2.0 (or equivalent for mobile devices, including hardware-backed keystore on smartphones and tablets).
• Secure Boot — Enabled and enforced. Devices that do not pass secure boot validation are blocked from network access until remediated.
• Disk Encryption — Full-volume encryption with the recovery key escrowed to the corporate management console.
• Endpoint Detection and Response (EDR) — Approved EDR agent installed, healthy, and reporting at the time of issuance.
• Mobile Device Management (MDM) Enrollment — Mandatory at first boot. Devices that fail to enroll cannot complete onboarding.
• Operating System Updates — Devices must be within the approved OS update window. Devices more than 60 days behind on cumulative updates are quarantined until remediated.
• Authentication — At minimum, password plus biometric or hardware token; passwordless preferred where supported.
• Local Administrator Rights — Disabled by default; granted by exception only.
• Removable Media Controls — USB mass-storage devices are blocked unless explicitly permitted by role.
• Remote Wipe Capability — All devices must be capable of remote wipe and located within the corporate management console.

4. Tier-Specific Requirements

Tier 2 — Sensitive Data Handling

In addition to Tier 1, devices used by Tier 2 roles must also meet:

• VPN-always-on profile, enforced through MDM.
• Conditional access bound to device compliance status; non-compliant devices cannot reach Tier 2 applications.
• Data-loss-prevention (DLP) policy active, with copy-paste and screenshot controls for applications handling customer data.
• Camera and microphone controls available to the user, with audit logging when toggled.

Tier 3 — Restricted Handling

In addition to Tier 1 and Tier 2, devices used by Tier 3 roles must also meet:

• Smart-card or FIDO2 hardware authenticator required for sign-in. Password-only sign-in is disabled.
• PIN-at-boot required for BitLocker.
• Privileged Access Workstation (PAW) policy applied; non-administrative software cannot be installed.
• Network segmentation enforced; Tier 3 devices may only reach administrative and monitoring zones.
• Local accounts disabled. Sign-in requires corporate identity and MFA.
• Physical access controls — intrusion-detection chassis sensors must be active where supported.

Tier 4 — Specialty / Air-Gapped

• All Tier 3 controls apply, with the following additional requirements:
• The device is not enrolled in the corporate identity directory; it operates against an isolated identity store.
• All inbound and outbound data transfers go through an approved data-diode or sanitization workflow.
• Issued through Exception-Only approval with annual recertification.

5. Mobile Device Security Requirements

In addition to the Tier 1 baseline, all smartphones and tablets must meet:

• Hardware-backed keystore for credentials and certificates.
• Full-device encryption enabled at first boot.
• MDM profile enrolled and locked. Removal of the corporate profile triggers an automatic wipe.
• App installation restricted to the corporate-managed catalog.
• Public Wi-Fi automatic-connection disabled by policy.
• Lock screen and biometric requirements enforced through MDM.

6. Field Workforce Security Requirements

Field devices share the mobile baseline plus additional measures:

• GNSS reporting active for asset-recovery purposes.
• VPN-always-on for any session with access to internal network configuration data.
• Tap-to-pair restricted to known peripherals through MDM allow-listing.
• Devices not reporting to MDM for more than 14 days are placed in the field-recovery workflow.

7. Retail Device Security Requirements

Retail point-of-sale tablets and handhelds operate under a locked-down kiosk profile:

• Device personalization is disabled. The device cannot be associated with an individual employee identity for customer-facing transactions.
• Cardholder data does not transit through the tablet’s storage; payment transactions flow only between the tap-to-pay reader and the payment processor.
• Devices automatically re-baseline to the kiosk image at the end of each business day.

8. Compliance and Audit

• Device compliance state is reported continuously to the corporate management console. The IT compliance team reviews exception trends monthly.
• Out-of-compliance devices are automatically blocked from accessing internal applications until remediated, except for break-glass scenarios documented in the IT Operations runbook.
• Annual recertification is required for all Tier 3 and Tier 4 devices.
• Loss or theft of a device must be reported within four hours through the IT Service Desk; the device is wiped and disabled within the management console.

9. Approved Encryption and Authentication Standards

• Symmetric encryption: AES-256.
• Asymmetric encryption: ECDSA P-384 minimum for new credentials.
• Disk encryption recovery keys are stored in the corporate identity directory and accessible only to the EUC service team under documented break-glass procedures.
• Hardware authenticators must be FIDO2-compliant and on the approved authenticator list maintained by the Information Security Office.

10. Deviations

Any deviation from these standards requires a documented risk acceptance approved by the Information Security Office and the device’s business owner. Deviations are tracked in the Hardware Exception Register and are time-bound; no permanent deviation is permitted for Tier 2 or higher devices.