Document Name: | Endpoint Protection Policy |
|
|
Classification: | Internal |
|
|
Document Owner: | CISO/MR |
|
|
Document Approver: | Top Management |
|
|
Original Document Issue Date: | 6/11/2026 |
|
|
Current Edition: | Version 1.0 |
|
|
Revision History: |
|
|
|
S. No. | Description of Change | Date of Change | Version No. |
1 | Initial Release | 6/11/2026 | 1.0 |
1. Purpose, Scope and Applicability
Purpose. This policy sets the mandatory security requirements for protecting all endpoints that store, process, or access Legistify information, to safeguard the confidentiality, integrity, and availability of company and client data and to support compliance with ISO/IEC 27001:2022 and the DPDP Act 2023.
Scope. Applies to all Linux (Ubuntu and others), Windows, and macOS laptops and desktops, servers (on-premises and cloud/AWS EC2), and other authorized endpoints.
Applicability. Applies to all employees, contractors, consultants, interns, and authorized third parties who use or administer in-scope endpoints. It complements, and does not replace, Legistify's Data Loss Prevention controls (delivered via Teramind) and related ISMS policies.
2. Roles and Responsibilities
Role | Responsibility |
Management | Approve the policy, allocate resources, and endorse enforcement. |
CISO | Own the policy; manage risk, exceptions, monitoring, and audit readiness.” to “Review and approve this policy. |
IT / DevOps | Build, harden, patch, encrypt, and monitor endpoints (Wazuh, anti-malware); run vulnerability scans; manage provisioning, decommissioning, and incident response. |
Employees, Contractors & Third Parties | Follow this policy, protect devices and credentials, report incidents, and complete training/acknowledgement. |
IT Manager | Develop and maintain this policy; take proactive steps to reinforce compliance of all stakeholders. |
3. Policy Statements (Mandatory Controls)
Area | Requirement | ISO 27001:2022 |
Secure configuration & hardening | Build from an approved, CIS-aligned baseline; disable unused services/ports; default-deny; auto screen-lock ≤10 min; no unapproved software. | 8.9, 8.19 |
Antivirus & malware | Approved anti-malware (e.g., ClamAV / Defender) enabled on every endpoint; daily signature updates; real-time + weekly scans; alerts to Wazuh. | 8.7 |
Area | Requirement | ISO 27001:2022 |
Patch management | Apply security patches by severity: Critical ≤ 48h (servers)/7d; High ≤ 7–14d; Medium ≤ 30d. No end-of-life software. | 8.8 |
Disk encryption | Full-disk encryption mandatory: BitLocker (Windows), LUKS (Linux), FileVault (macOS); recovery keys escrowed securely. | 8.24 |
Access control & PAM | Unique accounts, least privilege, MFA for remote/admin; no routine local-admin; privileged access time-bound, logged, and reviewed quarterly. | 5.15–5.18, 8.2, 8.5 |
Host firewall | Host firewall enabled, default-deny inbound; management ports never public; status monitored. | 8.20 |
Removable media | USB/removable storage blocked by default; approved use must be encrypted and scanned; activity monitored (Teramind). | 7.10, 8.12 |
Vulnerability management | At least monthly authenticated scans; riskrated findings remediated to patch SLAs and tracked to closure. | 8.8 |
Logging & monitoring | Wazuh agent on all endpoints; central collection of security events; logs retained [≥ 12 months]; alerts reviewed. | 8.15, 8.16 |
Incident response | Report incidents immediately; isolate affected endpoints; eradicate, recover from trusted build, and run post-incident review. | 5.24, 5.26 |
Remote access | Encrypted VPN + MFA; controls stay active off-site; lost/stolen devices reported at once. | 6.7, 7.9 |
Area | Requirement | ISO 27001:2022 |
Asset inventory | Maintain a current inventory of all endpoints (owner, OS, encryption/agent status); reconcile quarterly. | 5.9 |
Backup | Critical data stored in backed-up locations; encrypted backups with an off-site copy; restores tested periodically. | 8.13 |
Lifecycle | Secure provisioning from baseline; secure wipe on reassignment; secure data destruction and inventory update on decommissioning. | 5.11, 7.14, 8.10 |
4. Compliance, Awareness, Exceptions and Enforcement
Compliance. All users must keep security controls enabled and must not disable, bypass, or tamper with them. Compliance is monitored via Wazuh checks, patch/vulnerability status, access reviews, and periodic internal audits.
Awareness. Security awareness training is mandatory at induction and at least annually, covering phishing, safe device and media use, and incident reporting.
Exceptions. Any deviation requires a written, risk-assessed exception approved by the CISO, with compensating controls, a defined expiry, and a logged entry in the exceptions register.
Enforcement. Non-compliance may result in disciplinary action up to termination for employees, and suspension/termination of access and engagement for contractors, consistent with HR policy and applicable law.
5. Review, Approval and Acknowledgement
Review. This policy is reviewed at least annually and after significant change; material changes require re-approval and a new version entry.
Communication & acknowledgement. On approval the policy is published and communicated to all users, who must formally acknowledge it at onboarding and on each material revision; records are retained as audit evidence.
Policy Revision History
Date | Version | Author | Reviewer | Approver | Comments |
6/11/2026 | 1.0 | ISMS Manager | CIO | Legistify Services Pvt. Ltd. Management | Initial release of the Endpoint Protection Policy |