Endpoint configuration.
WHAT TO CONFIGURE
Disk encryption, with keys escrowed Update rings, controlling when updates arrive Endpoint protection settings Firewall rules Local administrator behaviour Baseline security settings
WHY KEY ESCROW MATTERS
Without it, an encrypted device that cannot be unlocked is unrecoverable.
WHAT UPDATE RINGS PROVIDE
Staged rollout of updates, so a problematic update does not reach everyone simultaneously.
WHAT TO CONFIGURE
A pilot ring receiving updates first, then broader rings.
WHAT TO RESTRICT
Local administrative rights.
WHY
It prevents a substantial proportion of incidents.
WHAT TO PROVIDE INSTEAD
A mechanism for temporary elevation where genuinely required.
WHAT SECURITY BASELINES PROVIDE
Recommended configuration applied as a set.
WHAT TO DO WITH THEM
Apply, then adjust where they conflict with legitimate needs, recording why.
WHAT TO MONITOR
Encryption status Patch compliance Devices not seen recently
WHY THAT LAST ONE
It may indicate a device lost, stolen, or held by someone who left.
WHAT TO TEST
Every policy on a pilot group first.
