What this control covers
Encrypt data on end-user devices containing sensitive data. Example implementations can include: Windows BitLocker®, Apple FileVault®, Linux® dm-crypt.
Why it matters
Endpoint posture (encryption, EDR, OS patch state) is also the most common evidence customers ask for in their vendor reviews.
How to implement
AWS
Bake hardening into EC2 Image Builder + AMI accounts; use Systems Manager Fleet Manager for inventory and patch state.
Azure
Intune enrolment for laptops + phones; Conditional Access requires "compliant device" before any corporate app loads. EDR via Defender for Endpoint.
Google Workspace
Endpoint Management (basic/advanced) for BYOD/COPE; require screen lock, disk encryption and OS minimum; block sign-in on jailbroken devices.
Evidence to collect
user_device_scan— Output from your MDM/EDR (Intune, Jamf, Kandji) showing managed-device count, posture and last-check-in.
Endpoint compliance telemetry (Intune, Jamf) proves managed coverage. Focus: Encrypt Data on End-User Devices.
Quick checklist
- Encrypt — End User / Sensitive
- Protect — End User / Sensitive
Related articles on this site
- Ensure EFS protects sensitive data with encryption at rest
- Ensure Amazon EFS Protects Sensitive Data with Encryption at Rest
- Ensure that encryption at rest is enabled for Amazon Athena query results stored in Amazon S3 in order to secure data and meet compliance requirements for data-at-rest encryption.
- Ensure Secrets and Sensitive Data Are Not Stored Directly in EC2 User Data