# CIS Controls v8 4.12 — Separate Enterprise Workspaces on Mobile End-User Devices - Source: https://support.icompaas.com/compliance/cis-controls-v8/4-12-separate-enterprise-workspaces-on-mobile-end-user-devices - Section: [Compliance](https://support.icompaas.com/compliance) › [CIS Critical Security Controls v8](https://support.icompaas.com/compliance/cis-controls-v8) › Control 4 — Secure Configuration of Enterprise Assets and Software - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **CIS Controls v8**·Control `4.12`·medium·Component: **Protect** ## What this control requires > Ensure separate enterprise workspaces are used on mobile end-user devices, where supported. Example implementations include using an Apple® Configuration Profile or Android™ Work Profile to separate enterprise applications and data from personal applications and data. > > — CIS Controls v8, Control 4.12 ### In plain English Ensure separate enterprise workspaces are used on mobile end-user devices, where supported. In practice, this means you can prove you ensure end user-level controls on a defined cadence. ## Why it matters The CIS Controls are an industry-vetted, prioritised defence: skipping a safeguard widens the attack surface that the safeguards above and below it assume is closed. Audit frameworks (FedRAMP, PCI DSS, HIPAA) all cite CIS as evidence of due care. ## What an auditor looks for A CIS-aligned reviewer wants to see (a) which Implementation Group you are targeting, (b) a documented owner for the safeguard, and (c) a tooling or process artefact (config, scan output, ticket) that proves the safeguard runs on the cadence the control demands. Within **Protect**, the assessor will trace your implementation back to the catalogue reference (Control 4.12) and look for objective evidence on the latest two assessment cycles. ## How to implement #### Cloud Posture **CSPM.** Run Wiz / Prisma / Defender for Cloud / Security Command Center over every account; auto-ticket findings above your accepted-risk threshold. #### Endpoint Protection **MDM.** Make MDM enrollment a hard gate for device access (Intune compliance + Conditional Access, or Jamf + Okta device trust). Unmanaged devices simply don't get a session token. **EDR.** Deploy CrowdStrike / SentinelOne / Defender for Endpoint to every server and laptop; alert on any host that stops sending telemetry for >24h. #### Configuration Management **Policy-as-code.** Codify the control as Service Control Policies (AWS), Azure Policy initiatives, or Organisation Policy (GCP) so the platform enforces what the document promises. **IaC.** Gate Terraform / Pulumi / CloudFormation changes with Checkov / tfsec / OPA so misconfigurations never reach production. **Drift.** Run a CSPM (Wiz / Prisma / Defender for Cloud / Security Command Center) over every account and route findings to a single risk register. ### Operational checklist - **Ensure.** Document the trigger, the owner and the cadence. - **Separate.** Document the trigger, the owner and the cadence. - **Protect.** Document the trigger, the owner and the cadence. - **Scope:** end user, mobile, network, applications, data, enterprise. ## Evidence to collect - **Infra Scan.** Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings. - **User Device Scan.** MDM compliance state per user device (Intune / Jamf / Workspace ONE). Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Endpoint compliance telemetry (Intune, Jamf) proves managed coverage. Focus: Separate Enterprise Workspaces on Mobile End-User Devices. ## Common pitfalls - Treating CSPM findings as a backlog instead of a hot queue: findings older than the policy SLA accumulate until the auditor asks why. - Pilot MDM rollouts that quietly exclude executives or engineers; carving out the highest-risk users is the most common audit failure. - Manual cloud-console changes that never make it back to Terraform — drift accumulates until the next outage forces a reconciliation. - Default-allow egress rules; East-West traffic with no segmentation; jump hosts on the public internet with password auth. ## How it maps to other frameworks Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit. - [**BSI C5:2020 COS-07** — Documentation of the network topology](https://support.icompaas.com/compliance/bsi-c5-2020/cos-07-documentation-of-the-network-topology) ## Related controls in CIS Controls v8 - [**Control 4.3** — Configure Automatic Session Locking on Enterprise Assets](https://support.icompaas.com/compliance/cis-controls-v8/4-3-configure-automatic-session-locking-on-enterprise-assets) - [**Control 14.5** — Train Workforce Members on Causes of Unintentional Data Exposure](https://support.icompaas.com/compliance/cis-controls-v8/14-5-train-workforce-members-on-causes-of-unintentional-data-exposure) - [**Control 4.5** — Implement and Manage a Firewall on End-User Devices](https://support.icompaas.com/compliance/cis-controls-v8/4-5-implement-and-manage-a-firewall-on-end-user-devices) - [**Control 12.6** — Use of Secure Network Management and Communication Protocols](https://support.icompaas.com/compliance/cis-controls-v8/12-6-use-of-secure-network-management-and-communication-protocols) - [**Control 12.8** — Establish and Maintain Dedicated Computing Resources for All Administrative Work](https://support.icompaas.com/compliance/cis-controls-v8/12-8-establish-and-maintain-dedicated-computing-resources-for-all-administrative-work) - [**Control 4.9** — Configure Trusted DNS Servers on Enterprise Assets](https://support.icompaas.com/compliance/cis-controls-v8/4-9-configure-trusted-dns-servers-on-enterprise-assets) ## References - [Center for Internet Security — CIS Controls v8](https://www.cisecurity.org/controls/v8) - Catalogue identifier: `Control 4.12` Topics: endpoint securitynetwork securitycloud postureendpoint protectionconfiguration management ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.