CIS · Control 4.10 · Priority: high · Component: Respond

What this control covers

Enforce automatic device lockout following a predetermined threshold of local failed authentication attempts on portable end-user devices, where supported. For laptops, do not allow more than 20 failed authentication attempts; for tablets and smartphones, no more than 10 failed authentication attempts. Example implementations include Microsoft® InTune Device Lock and Apple® Configuration Profile maxFailedAttempts.

Why it matters

Endpoint posture (encryption, EDR, OS patch state) is also the most common evidence customers ask for in their vendor reviews.

How to implement

AWS

Bake hardening into EC2 Image Builder + AMI accounts; use Systems Manager Fleet Manager for inventory and patch state.

Azure

Intune enrolment for laptops + phones; Conditional Access requires "compliant device" before any corporate app loads. EDR via Defender for Endpoint.

GCP

Org Policy Service for guardrails and Config Validator in CI to pre-check Terraform plans against policy as code (Rego).

Google Workspace

Endpoint Management (basic/advanced) for BYOD/COPE; require screen lock, disk encryption and OS minimum; block sign-in on jailbroken devices.

GitHub

Require SSO + SCIM from your IdP on the organisation; enforce 2FA org-wide and use fine-grained PATs (or, better, GitHub Apps) instead of classic tokens. Restrict outside collaborators, require signed commits on protected branches, and use OIDC from Actions to short-lived AWS/GCP/Azure credentials rather than stored secrets.

Zoho Mail

Make two-factor authentication mandatory for all users (TOTP, OneAuth, or YubiKey) in Admin Console → Security. Configure SAML SSO against your IdP and disable password-based logins for admins. Use role-based privileges (Admin / Spam Moderator / Mail Account Admin) and review the Login history report monthly for anomalies.

Evidence to collect

  • user_device_scan — Output from your MDM/EDR (Intune, Jamf, Kandji) showing managed-device count, posture and last-check-in.

Endpoint compliance telemetry (Intune, Jamf) proves managed coverage. Focus: Enforce Automatic Device Lockout on Portable End-User Devices.

Quick checklist

  • Enforce — End User / Portable

Related articles on this site