# ISO/IEC 27001 8.1 — User end point devices

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_iso27001_81_1bfde857ae-isoiec-27001-81-user-end-point-devices
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [ISO/IEC 27001:2022](https://support.icompaas.com/support/solutions/c_gen_iso27001) › [Technological controls](https://support.icompaas.com/support/solutions/folders/f_gen_cgeniso27001_technologicalcontrols)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

ISO/IEC 27001 · Control 8.1 · Priority: high · Component: Technological controls

### What this control covers

Information stored on, processed by or accessible via user end point devices shall be protected.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `edr_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.
-   `user_device_scan` — Output from your MDM/EDR (Intune, Jamf, Kandji) showing managed-device count, posture and last-check-in.
-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

MDM posture (Intune, Jamf) and EDR telemetry (Defender for Endpoint) demonstrate managed and protected user endpoints.

### Quick checklist

-   Policy — Information / Management
-   Information — Information / Management
-   Management — Information / Management

### Related articles on this site

-   [CMMC 2.0 AC.1.004 Control Public Information Control information posted or processed on publicly accessible information systems.](https://support.icompaas.com/support/solutions/articles/62000229382-cmmc-2-0-ac-1-004-control-public-information-control-information-posted-or-processed-on-publicly-acce)
-   [NIST 800-171 3.1.1 Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).](https://support.icompaas.com/support/solutions/articles/62000229223-nist-800-171-3-1-1-limit-information-system-access-to-authorized-users-processes-acting-on-behalf-of)
-   [NIST 800-171 3.1.22 Control CUI posted or processed on publicly accessible systems.](https://support.icompaas.com/support/solutions/articles/62000229263-nist-800-171-3-1-22-control-cui-posted-or-processed-on-publicly-accessible-systems-)
-   [NIST 800-171 3.8.6 Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.](https://support.icompaas.com/support/solutions/articles/62000229315-nist-800-171-3-8-6-implement-cryptographic-mechanisms-to-protect-the-confidentiality-of-cui-stored-on)