Â鶹´«Ã½

Endpoints — Minimum Security Standards

Last Updated 2023-02-06

An endpoint is any desktop or laptop.

Please refer to the Implementation Guides for assistance with implementing the minimum security standard for your device.

Key

Item	Description
	Implementation required
	Implementation recommended
	Recurring task

When working with Regulated Data, please refer to the applicable Standard, Act, or Policy (e.g., CMMC, PCI DSS, HIPAA, FERPA, NIST SP800-171, etc.) for specific details on any additional controls needed.

The standards listed below are adapted from a subset of the Center for Internet Security's (CIS) Controls, which are a prioritized set of actions that collectively form a defense-in-depth set of best practices that mitigate the most common attacks against systems and networks. The subset of CIS Controls were chosen based on their applicability to the University of Â鶹´«Ã½.

Quick Reference

• 1.0 - Automatic Updates
• 2.0 - Firewall Configuration
• 3.0 - Password Security
• 4.0 - Data Management
• 5.0 - Encryption
• 6.0 - Asset Management
• 7.0 - Data Inventory
• 8.0 - Removable Media
• 9.0 - Malware Protection
• 10.0 - Session Timeout
• 11.0 - Backups

#	Standards		Institutional Data Category
1.0	Automatic Updates	Recurring Task	Public	Restricted	Sensitive	Regulated
1.1	Enable automatic operating system and software updates.
1.2	Ensure all software is kept up to date.
1.3	Ensure operating systems and software including email clients and browsers are fully supported by their vendors. End-of-life software and operating systems do not receive security updates.
2.0	Firewall Configuration	Recurring Task	Public	Restricted	Sensitive	Regulated
2.1	Ensure that host-based firewalls are enabled with a default deny-all policy.
3.0	Password Security	Recurring Task	Public	Restricted	Sensitive	Regulated
3.1	Ensure all users have individually dedicated endpoint account logins with strong and unique password for each user.
4.0	Data Management	Recurring Task	Public	Restricted	Sensitive	Regulated
4.1	Utilize the University's records management process for .
4.2	Securely dispose of Institutional Data following our Disposal Guidelines.
4.3	Utilize Spirion to scan for sensitive and regulated information on a monthly basis.
5.0	Encryption	Recurring Task	Public	Restricted	Sensitive	Regulated
5.1	Utilize Â鶹´«Ã½Filedrop or Â鶹´«Ã½Enterprise Dropbox to transfer files securely.
5.2	Utilize Windows BitLocker or Apple FileVault to enable whole disk encryption on endpoints and removable devices
5.3	Utilize Â鶹´«Ã½Enterprise Dropbox to store Sensitive and Regulated data online.
6.0	Asset Management	Recurring Task	Public	Restricted	Sensitive	Regulated
6.1	Complete the Annual Device Registration.
7.0	Data Inventory	Recurring Task	Public	Restricted	Sensitive	Regulated
7.1	Complete the annual Personal Information Survey (PIS).
8.0	Removable Media	Recurring Task	Public	Restricted	Sensitive	Regulated
8.1	Disable autorun / autoplay for removable media.
9.0	Malware Protection	Recurring Task	Public	Restricted	Sensitive	Regulated
9.1	Ensure an anti-malware solution is enabled.
9.2	Ensure automatic anti-malware signature updates are enabled.
9.3	Enable anti-exploitation features.
10.0	Session Locking	Recurring Task	Public	Restricted	Sensitive	Regulated
10.1	Enable automatic session locking (maximum 15-minutes) on endpoints.
11.0	Backups	Recurring Task	Public	Restricted	Sensitive	Regulated
11.1	Maintain an offline backup instance. Update backup instances on a weekly basis.
11.2	Ensure backups are encrypted.