control
endpoint management
One console that configures, updates, encrypts and, if needed, wipes the company laptops and phones. It carries parts of several rules, and it needs the protection of an administrator account.
- what it protects
- company laptops and phones, so that each one is known, patched, encrypted and can be closed down when lost
- who owns it
- head of IT
- start with
- the device list and a minimum state, then the console accounts
what it is
Endpoint management is the control for company laptops and phones. One console enrols each device, sets its configuration, pushes updates, enforces disk encryption and, when a device is lost, locks or wipes it. For an IT owner it is how the company knows what it has and what state it is in.
NIS2 asks for asset management and for maintenance, which covers patching. DORA asks for a patch policy. GDPR names encryption of personal data as an appropriate measure. A managed device fleet is where those four things become visible in one report.
Start with the list of devices and the minimum state each must meet: enrolled, encrypted, patched. Then protect the console itself. It holds the power to change or erase every device, so its accounts belong in the same group as your administrators.
basis NIS2 Art. 21(2)(i), 21(2)(e); DORA Art. 9(4)(f); GDPR Art. 32(1)(a). The minimum state and the console rules are practice.
what the device console does, and who guards it
- 1enroleach device is listed with an owner
- 2configuresettings and a minimum state are pushed
- 3update and encryptpatches go out and disks are encrypted
- 4reportone view of who is in the state and who is not
- 5lock or wipea lost device is closed down and the action is recorded
the console can change every device, so its accounts need
- strong sign-ina method a fake page cannot answer
- few peoplenamed, and reviewed every quarter
- least privilegeeach person gets only the actions the job needs
- second approvalfor a wipe or a push to many devices
basis working practice. No legal text sets this.
an example
Picture a company of a few hundred people that manages its laptops from one console.
Several people share a console login with a plain password. A few laptops were never enrolled, the compliance report counts only the ones it knows, and a leaver kept the laptop and the account. If the console login leaks, an attacker can push software or wipe every device.
The device list matches the asset list and the sign-in records for company mail. The minimum state is enrolled, encrypted and patched. Console accounts are named, use a method a fake page cannot answer, and a wipe of many devices needs a second person.
An illustration. It is not a real case.
what it has to do for each rule
| rule | where | what the text asks | what the control has to do |
|---|---|---|---|
| NIS2 | NIS2 Art. 21(2)(i) | Human resources security, access control policies and asset management. | Know which devices belong to the company and who has each one. Enrol them in the console and take them off when people leave. |
| NIS2 | NIS2 Art. 21(2)(e) | Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure. | Set a patch routine for operating systems and apps on every managed device, and report which ones are behind. |
| DORA | DORA Art. 9(4)(f) | Appropriate and comprehensive documented policies for patches and updates. | Write the patch policy and show from the console that devices follow it. |
| GDPR | GDPR Art. 32(1)(a) | As appropriate, the pseudonymisation and encryption of personal data. | Turn on disk encryption on laptops and phones and show how many are encrypted. A lost device then does not hand over its data. |
basis NIS2 Art. 21(2)(i), 21(2)(e); DORA Art. 9(4)(f); GDPR Art. 32(1)(a). What the control has to do is practice.
what to look for when you choose
- Does it cover every kind of device you issue: laptops, phones, tablets, and the mix of operating systems you run?
- Can you see, in one report, which devices are encrypted, patched and enrolled, and which are not?
- Can you lock or wipe a lost device at once, and is the wipe recorded?
- Does it let you set a minimum state a device must meet before it reaches company mail and files?
- Who can sign in to the console, with what strength of authentication, and can one person alone push a change or wipe to every device?
- Can a large action, such as a wipe of many devices, require a second person to approve it?
- How does it handle personal phones used for work, and what does it see on them?
- What happens to the devices if the console or the service behind it is unavailable?
basis working practice. No legal text sets this.
three levels, from first step to strong
Each level adds something visible. Stop where the risk you accepted allows.
- start
List every company device, set the minimum state of enrolled, encrypted and patched, and enrol what is missing.
- solid
Compare the console with the asset list each quarter, block company mail on devices that miss the minimum and tie leaving to one checklist for the laptop and the account.
- strong
Give console administrators security keys or passkeys, least privilege and a second approver for large actions, and test a lock and a wipe on a spare device.
basis working practice. No legal text sets this.
where it goes wrong
the console is the target
The console that manages every device can also take every device away. Whoever controls it can push software, change settings and wipe laptops and phones in one move. Treat its accounts like administrator accounts: strong authentication that cannot be tricked by a fake page, few people, least privilege and approval from a second person for large actions. In March 2026 the US cybersecurity agency CISA published an alert urging organisations to harden their endpoint management systems.
devices nobody enrolled
A laptop that never entered the console is invisible to patching and encryption. Compare the console with the asset list and with the sign-in records for company mail.
reports that show only the managed devices
A compliance percentage counts the devices it knows. It says nothing about the ones it does not.
leavers keep the device and the access
Offboarding that collects the laptop but leaves the account, or the reverse, leaves a gap. Tie the two to one checklist.
basis practice. The CISA alert of 18 March 2026 is a public warning, not a legal text.
the proof it leaves
| what you can show | who owns it | refresh |
|---|---|---|
| device list with owner, enrolment date and status | head of IT | quarterly |
| encryption and patch status report from the console | head of IT | monthly |
| list of console administrators with their authentication method and last review | head of IT | quarterly |
| record of lock and wipe actions and the approvals behind large ones | head of IT | quarterly |
basis practice. The rhythms are your choice.
check it yourself
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
your next step
Count the people who can sign in to the device console and check that each one has a strong second factor.