A.8.1 Technological
User end point devices
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (15)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-19mostlycovers — Both controls establish requirements for managing and securing mobile and personally-owned endpoint devices, including registration, access controls, encryption, remote wipe, and separation of personal versus organizational use.
- CM-6mostlyaligns with — Both require standardized, centrally enforced configuration settings on endpoint devices such as software versions, automatic updates, port disabling, and firewall rules.
- MP-7mostlyaligns with — Both address restrictions on the use of removable media and physical ports on endpoint devices to limit unauthorized data transfer.
- AC-17partialaligns with — Both require controls on how endpoint devices connect to organizational networks and services from off-premises locations.
- AT-2partialaligns with — Both emphasize user awareness and responsibility for protecting endpoint devices and following security procedures.
- SC-28partialaligns with — Both require encryption of data stored on endpoint devices to protect information at rest.
- SI-3partialaligns with — Both mandate protection of endpoint devices against malware through technical and procedural controls.
Aligned NIST CSF 2.0 outcomes (15)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.AA-05mostlyaligns with — Requirements for access controls, authentication, and authorization on endpoint devices map to the CSF outcome of defining, managing, and enforcing access permissions and entitlements.
- PR.DS-01mostlyaligns with — Mandating encryption, malware protection, and physical safeguards for data stored on endpoint devices aligns with protecting the confidentiality, integrity, and availability of data-at-rest.
- PR.PS-01mostlyaligns with — The ISO control's emphasis on establishing and enforcing secure configuration baselines for endpoint devices directly supports the CSF outcome of applying configuration management practices across technology platforms.
- PR.PS-05mostlyaligns with — Restrictions on software installation and the use of removable devices correspond to the CSF outcome of preventing installation and execution of unauthorized software.
- ID.AM-01partialaligns with — Registration of user endpoint devices supports the CSF outcome of maintaining inventories of hardware managed by the organization.
- PR.AT-01partialaligns with — The control's user-responsibility and awareness provisions contribute to ensuring personnel have the knowledge needed to protect endpoint devices.
- PR.IR-01partialaligns with — Rules governing network connections and remote access from endpoint devices help protect networks and environments from unauthorized logical access.
Related OWASP ASVS 5.0 requirements (6)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Related weaknesses / CWE (11)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-200partialprevents — Mandating encryption of storage devices and restricting what classified information may be stored on endpoints reduces the chance that sensitive data will be exposed if a device is lost or stolen.
- CWE-284partialprevents — Requiring access controls, device registration, and remote lock/wipe capabilities on endpoint devices directly blocks unauthorized actors from reaching protected resources or data.
- CWE-522partialmitigates — Requiring logical controls such as passwords or PINs on idle devices and the use of remote lockout mechanisms protects credentials and other sensitive material from offline extraction.
- CWE-732partialprevents — Enforcing secure default configurations, software restrictions, and physical-port controls limits the opportunity for incorrect or overly permissive permission assignments on endpoint resources.
- CWE-250nonenone — Limiting software installation rights to administrators and enforcing separation of personal versus business data reduces the chance that ordinary users operate with unnecessary privileges.
- CWE-300nonenone — Endpoint device security supports but does not directly ensure channel integrity.
- CWE-525nonenone — Endpoint device configuration can enforce cache-clearing or no-cache policies for sensitive web content.
- CWE-539nonemitigates — Endpoint device configuration can enforce cookie lifetime and encryption policies.
- CWE-798nonenone — Requiring centralized configuration management and automatic updates makes it harder for hard-coded or default credentials to remain on endpoint devices in production use.
Mitigated MITRE ATT&CK techniques (6)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1005partialmitigates — Enforcing encryption, access controls, and remote-wipe capabilities on endpoint devices makes it harder for an adversary to retrieve stored files without detection or authorization.
- T1025partialmitigates — Rules governing removable media and the option to disable USB ports limit an attacker’s ability to collect data onto external drives from the endpoint.
- T1056partialmitigates — Requiring physical and logical locks on unattended devices and privacy filters in public areas directly reduces the window for an adversary to capture keystrokes or screen contents from an endpoint.
- T1219partialmitigates — Restrictions on installing or running unapproved remote-access or remote-desktop software curb an attacker’s ability to maintain persistent external control of the device.
- T1078.003nonemitigates — Mandatory device registration, authentication, and remote lock-out procedures reduce the usefulness of stolen or lost local accounts for accessing organizational resources.
- T1564.001nonemitigates — Configuration management and automated enforcement of approved software versions and partitions make it more difficult for malware to hide files or processes on the endpoint.
Prevented OWASP Web Top 10 (2025) risks (5)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A02mostlyprevents — Mandating secure baseline configurations, automatic patching, restricted software installation, and enforced separation of business data on endpoint devices directly eliminates the insecure defaults and unpatched software that constitute security misconfiguration.
- A04partialmitigates — Requiring storage-device encryption and secure configuration of endpoint devices prevents exposure of sensitive data through missing or weak cryptographic protections.
- A01nonemitigates — Device registration, access controls, remote lock/wipe, and encryption requirements limit the ability of lost or stolen endpoints to be used for unauthorized data access.
- A07nonemitigates — Logical controls such as password-protected lock screens and session termination reduce the window during which an unattended or lost device can be abused for unauthorized authentication.
- A09nonemitigates — End-user behavior analytics and the requirement to log off sessions provide telemetry that can be fed into centralized logging and alerting systems to detect anomalous endpoint activity.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.