Which standards require an endpoint device policy?

ISO/IEC 27001:2022: 8.1, 8.7; ISO/IEC 27701:2025: A.3.22; The NIS2 Directive: Art. 21(2)(g).

What must an endpoint device policy contain under ISO 27001?

8.1: Protect information stored on, processed by or reachable through user endpoints. 8.7: Implement malware protection backed by user awareness. The ISO 27002 guidance beside 8.1: Requires information stored on, processed by or accessible through user endpoint devices to be protected.

Who should own the endpoint device policy?

The clauses imply the head of IT operations. The register names the role so the line on your list can carry a name.

How often should an endpoint device policy be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for an endpoint device policy?

Yes: https://compliance.theartofservice.com/policy-templates/endpoint-protection-policy

Every policy type · Operations and technology

Endpoint device policy

How laptops, desktops and other user devices are built, protected against malware, encrypted, monitored and recovered.

How the register reads it

Also called	endpoint protection, malware protection, laptop policy
Family	Operations and technology
Document type	Policy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Expected owner	The head of IT operations.
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	ISO 27001 is ticked and no line resolves to it (ISO 27701, NIS2 require it too, inside a parent document, so they do not list it separately).
Template	Endpoint protection policy.

Which standards require it, and what each expects it to contain

4 requiring clauses, 3 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 8.1 User end point devices

Protect information stored on, processed by or reachable through user endpoints.

What the ISO 27002 guidance expects the document to say: Requires information stored on, processed by or accessible through user endpoint devices to be protected.

Evidence an auditor accepts: The endpoint device policy covering corporate and personally owned devices, registration, permitted use and required protections; configuration baselines for each device type and evidence of compliance across the estate, with the percentage of devices compliant; evidence of the protective measures in force, such as full disk encryption, endpoint detection, screen lock, patch currency and restriction of administrative rights
Common gap: Incomplete device inventory
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO 27001 8.7 Protection against malware

Implement malware protection backed by user awareness.

What the ISO 27002 guidance expects the document to say: Requires malware protection to be put in place and reinforced by suitable awareness among users.

Evidence an auditor accepts: Malware protection deployment records showing coverage across servers, endpoints, mobile devices, email and web gateways; configuration evidence including update frequency, scanning scope, real time protection and the action taken on detection; coverage reporting showing devices without protection or with outdated definitions, and the follow up on them
Common gap: Outdated malware signatures not regularly updated
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO/IEC 27701:2025

ISO 27701 A.3.22 User endpoint devices

The organization shall ensure that the use of mobile and other user endpoint devices does not lead to a compromise of PII, through the device rules, protections and handling requirements it applies to endpoints that access or store PII.

Evidence an auditor accepts: Endpoint and mobile device rules addressing PII specifically; technical protections on devices that access PII, such as encryption, remote wipe and access control; evidence the rules reach personal devices where these are permitted
Common gap: Mobile rules that address device loss but not PII stored in applications and caches
Source: ISO/IEC 27701:2025

The NIS2 Directive

NIS2 Art. 21(2)(g) Basic cyber hygiene practices and cybersecurity training

Cyber hygiene is the common baseline the Directive expects everywhere: keeping software and hardware updated, managing configuration of devices, controlling and limiting administrator-level accounts, managing new installations, changing credentials, segmenting networks and backing up data. The recitals also point at zero-trust principles and user awareness as part of the same baseline. Training here is the workforce limb, distinct from the management body training in Article 20(2), and it needs to reach the roles that actually handle the risk rather than being one annual module for everyone. The value of this category to an auditor is that it is measurable: patch currency, privileged account counts and training completion are all countable, and a claim of good hygiene that cannot produce those numbers is not evidenced.

Evidence an auditor accepts: Patch and update currency reporting across the in-scope estate, including exceptions; secure configuration baselines and compliance measurement against them; the privileged account inventory with justification and periodic review
Common gap: Hygiene asserted for servers while endpoints, network devices and operational technology are unmeasured
Source: NIS2 Directive

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Email and messaging policy · Environmental security standard