Endpoint and mobile device security audit program.
How to audit whether desktops, laptops, smartphones and tablets are managed uniformly, hardened, encrypted and locked quickly when lost.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation controls its endpoints across their whole life cycle: from commissioning with a hardened baseline configuration through malware protection, updating and encryption to return and wiping. For mobile devices it assesses whether a mobile device management solution enforces the requirements effectively.
Scope
- Desktops and laptops running the operating systems in use
- Company smartphones and tablets, and private devices where used for work
- Tools for software distribution, malware protection and mobile device management
- Out of scope: servers and network components, which have their own audit programs
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A policy governs procurement, configuration, use and return of endpoints, including mobile devices. | ISO/IEC 27001:2022 Annex A 8.1; BSI SYS.2.1 | Read the policy, check approval and compare it with the device types actually in use. | Endpoint policy with approval, overview of device types |
| 2 | Only managed and registered devices gain access to company data. | ISO/IEC 27001:2022 Annex A 8.1; BSI SYS.3.2.2 | Review access rules for email and file storage and trace whether unregistered devices are rejected. | Access rule configuration, list of registered devices |
| 3 | Endpoints are rolled out with a hardened baseline configuration; deviations are detected. | BSI SYS.2.1; ISO/IEC 27001:2022 Annex A 8.9 | Review the baseline and read key settings such as firewall, screen lock and autostart on five devices. | Baseline configuration, group policies or profiles, readout of the sample |
| 4 | Malware protection is active and current on all devices and reports detections centrally. | ISO/IEC 27001:2022 Annex A 8.7; BSI OPS.1.1.4 | Analyse the central console: coverage, signature status and devices that have not reported in seven days. | Protection solution report on coverage and status, detection list |
| 5 | Operating systems and applications are updated promptly; devices that are not updated are followed up. | ISO/IEC 27001:2022 Annex A 8.8 | Analyse the patch status of endpoints from the distribution tool and trace the handling of stragglers. | Patch report, list of outdated devices with actions |
| 6 | Storage on laptops and mobile devices is fully encrypted, and recovery keys are stored securely. | BSI SYS.3.1; ISO/IEC 27001:2022 Annex A 8.24 | Retrieve the encryption status from the management console and check access to recovery keys. | Encryption report, permissions on the key store |
| 7 | Mobile device management enforces requirements such as device lock, encryption and a minimum operating system version. | BSI SYS.3.2.2; BSI SYS.3.2.1 | Review profiles and compliance rules in the MDM and trace non-compliant devices and their handling. | MDM profiles, compliance report, list of non-compliant devices |
| 8 | Business and private data are separated on mobile devices; the use of private devices is governed. | BSI SYS.3.2.1; ISO/IEC 27001:2022 Annex A 8.1 | Read the rule on private devices and have the technical separation (containers, app protection policies) demonstrated on a device. | Rule on private device use, app protection policy configuration |
| 9 | Local administrator rights are restricted; users can install software only through approved channels. | ISO/IEC 27001:2022 Annex A 8.2 and 8.19 | Read members of the local administrator groups on a sample and reconcile exceptions with their justification. | Readout of local groups, exception list with approvals |
| 10 | The use of removable media is governed and technically restricted. | ISO/IEC 27001:2022 Annex A 7.10; BSI SYS.4.5 | Read the rule and check the technical block or allow list for removable media on one device. | Removable media rule, device control policy |
| 11 | Lost or stolen devices are reported without delay, locked and wiped remotely where needed. | BSI SYS.3.2.2; ISO/IEC 27001:2022 Annex A 6.8 | For three loss reports in the last twelve months, trace report, lock and remote wipe with timestamps. | Loss reports, log of MDM actions, incident tickets |
| 12 | On leaving or disposal, devices are taken back and wiped securely before re-use. | ISO/IEC 27001:2022 Annex A 5.11 and 7.14 | Select five leavers and trace the return and wiping of their devices. | Return records, wiping evidence |
Documents to request
- Endpoint policy and rule on private devices
- Baseline configuration per operating system
- Malware protection report
- Endpoint patch report
- Encryption report
- MDM profiles and compliance report
- Exception list for local administrator rights
- Loss reports and remote wipe log
Typical findings
- Part of the fleet has not reported to the protection solution for weeks.
- Users have permanent local administrator rights without justification.
- Laptops are not consistently encrypted, recovery keys are stored unprotected.
- Private devices access email and files without registration.
- Lost devices are reported late and not wiped remotely.
- Returned devices are reissued without wiping evidence.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing