CC6.8: Endpoint protection
CC6.8 tests the laptops. Deixic pushes the profiles through your device management or the one Deixic provides, reads each device's state, and sends unmanaged laptops to you.
What CC6.8 asks
CC6.8 asks that the company stop unauthorized or malicious software from running on its systems, and detect it when it does.
For a startup, the auditor tests the laptop fleet: managed, encrypted, locked when idle, patched, and running endpoint protection.
Source: AICPA Trust Services Criteria (2017, with revised points of focus 2022). This page paraphrases the criterion.
Tests that fail, and what Deixic does
Each row is a test from your compliance platform and the change Deixic makes in the connected system.
| Failing test | What Deixic does | Authority |
|---|---|---|
| Disk encryption is on for every managed laptopKandji, Jamf Pro, SimpleMDM | Pushes a FileVault or BitLocker profile and stores the recovery key in device management. | Runs under written policy |
| Screen lock is enforcedKandji, Jamf Pro, SimpleMDM | Pushes a profile that locks the screen at the idle time written in your policy. | Runs under written policy |
| Operating systems are on a supported, patched versionKandji, Jamf Pro, SimpleMDM | Sets the update deadline from your policy. A deadline that forces a restart waits for an approver. | Waits for a named approver |
| Endpoint protection is installed and runningKandji, Jamf Pro, SimpleMDM | Deploys the endpoint protection agent your policy names to enrolled devices. | Runs under written policy |
| Every laptop is enrolled in device managementKandji, Jamf Pro, SimpleMDM | Lists laptops that sign in to company systems and are not enrolled, with their owners. | Goes to you as a decision |
What waits, and what Deixic refuses
Approvals name a person and record a reason. Decisions are actions outside the authority your policy grants.
Waits for a named approver
- An update deadline that restarts a laptop without asking its owner.
- A profile that applies to every device at once, such as a new passcode requirement.
Never run without your decision
- Wiping, locking, or retiring a device. Deixic never runs a remote wipe.
- Choosing the endpoint protection agent when the policy names none.
- Enrolling a laptop. The owner has to hand it over or install the profile.
What Deixic reads back
After each change Deixic reads the setting from the system itself.
| System | Read back |
|---|---|
| Device management | Per device: encryption status, lock timeout, OS version, and agent status. |
| Device management | The profile as installed on the device, not the profile as sent. |
Evidence your auditor receives
One signed, hash-linked receipt per change, exported as PDF, HTML, or JSON.
- Device inventory with each device's state before and after
- The profiles pushed and the policy section that names them
- Recovery key escrow status per device
- Approver and reason for restart deadlines
- The re-run result of the test in your compliance platform