{
"version": "0.3.0",
"chunks": [
{
"id": "fix:password.min_length:windows",
"kind": "fix",
"title": "Minimum password length on Windows",
"text": "Minimum password length on Windows. Why it matters: Short passwords can be guessed or cracked quickly; length is the strongest single factor in password strength. Risk if missing: Medium - Weak passwords make account takeover through guessing or credential stuffing easier. Requirement: Configured minimum length >= PASSWORD_MIN_LENGTH. How to fix on Windows: (1) Set Group Policy: Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy > Minimum password length = 14 (or the Intune equivalent). (2) For a stand-alone device: net accounts /minpwlen:14 How to verify: Re-run the audit; Minimum password length should read 14 or more. Related controls: ISO 27001:2022 A.5.17 (Authentication information); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "password.min_length"
},
{
"id": "fix:password.min_length:linux",
"kind": "fix",
"title": "Minimum password length on Linux",
"text": "Minimum password length on Linux. Why it matters: Short passwords can be guessed or cracked quickly; length is the strongest single factor in password strength. Risk if missing: Medium - Weak passwords make account takeover through guessing or credential stuffing easier. Requirement: Configured minimum length >= PASSWORD_MIN_LENGTH. How to fix on Linux: (1) Install pam_pwquality (Debian/Ubuntu: apt install libpam-pwquality) and make sure it is listed in the PAM password stack. (2) Set minlen = 14 in /etc/security/pwquality.conf. How to verify: Re-run the audit; Minimum password length should read 14 or more. Related controls: ISO 27001:2022 A.5.17 (Authentication information); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "password.min_length"
},
{
"id": "fix:password.min_length:macos",
"kind": "fix",
"title": "Minimum password length on macOS",
"text": "Minimum password length on macOS. Why it matters: Short passwords can be guessed or cracked quickly; length is the strongest single factor in password strength. Risk if missing: Medium - Weak passwords make account takeover through guessing or credential stuffing easier. Requirement: Configured minimum length >= PASSWORD_MIN_LENGTH. How to fix on macOS: (1) Deploy a Passcode configuration profile through your MDM with minLength = 14. How to verify: Re-run the audit; Minimum password length should read 14 or more. Related controls: ISO 27001:2022 A.5.17 (Authentication information); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "password.min_length"
},
{
"id": "fix:password.history:windows",
"kind": "fix",
"title": "Password history on Windows",
"text": "Password history on Windows. Why it matters: Without a password history, users can return to old, possibly exposed passwords. Risk if missing: Low - Reused passwords keep compromised credentials valid. Requirement: Remembered passwords >= PASSWORD_HISTORY. How to fix on Windows: (1) Set Group Policy: Account Policies > Password Policy > Enforce password history = 24. (2) For a stand-alone device: net accounts /uniquepw:24 How to verify: Re-run the audit; Password history should read 24 or more. Related controls: ISO 27001:2022 A.5.17 (Authentication information); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "password.history"
},
{
"id": "fix:password.history:linux",
"kind": "fix",
"title": "Password history on Linux",
"text": "Password history on Linux. Why it matters: Without a password history, users can return to old, possibly exposed passwords. Risk if missing: Low - Reused passwords keep compromised credentials valid. Requirement: Remembered passwords >= PASSWORD_HISTORY. How to fix on Linux: (1) Add pam_pwhistory to the PAM password stack before pam_unix (e.g. 'password requisite pam_pwhistory.so remember=24 use_authtok'). (2) Or set remember = 24 in /etc/security/pwhistory.conf where supported. How to verify: Re-run the audit; Password history should read 24 or more. Related controls: ISO 27001:2022 A.5.17 (Authentication information); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "password.history"
},
{
"id": "fix:password.history:macos",
"kind": "fix",
"title": "Password history on macOS",
"text": "Password history on macOS. Why it matters: Without a password history, users can return to old, possibly exposed passwords. Risk if missing: Low - Reused passwords keep compromised credentials valid. Requirement: Remembered passwords >= PASSWORD_HISTORY. How to fix on macOS: (1) Deploy a Passcode configuration profile with pinHistory = 24. How to verify: Re-run the audit; Password history should read 24 or more. Related controls: ISO 27001:2022 A.5.17 (Authentication information); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "password.history"
},
{
"id": "fix:password.expiration:windows",
"kind": "fix",
"title": "Password expiration on Windows",
"text": "Password expiration on Windows. Why it matters: The baseline requires passwords to be changed within a set period, limiting how long a stolen password stays useful. Risk if missing: Low - A leaked password can stay valid indefinitely. Requirement: Passwords expire after 1..PASSWORD_MAX_AGE_DAYS days (0 in the baseline = expiry not required). How to fix on Windows: (1) Set Group Policy: Account Policies > Password Policy > Maximum password age = 365 days. (2) For a stand-alone device: net accounts /maxpwage:365 How to verify: Re-run the audit; Password expiration should be between 1 and 365 days. Related controls: ISO 27001:2022 A.5.17 (Authentication information); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "password.expiration"
},
{
"id": "fix:password.expiration:linux",
"kind": "fix",
"title": "Password expiration on Linux",
"text": "Password expiration on Linux. Why it matters: The baseline requires passwords to be changed within a set period, limiting how long a stolen password stays useful. Risk if missing: Low - A leaked password can stay valid indefinitely. Requirement: Passwords expire after 1..PASSWORD_MAX_AGE_DAYS days (0 in the baseline = expiry not required). How to fix on Linux: (1) Set PASS_MAX_DAYS 365 in /etc/login.defs (applies to new accounts). (2) Apply it to existing accounts: chage --maxdays 365 <user> How to verify: Re-run the audit; Password expiration should be between 1 and 365 days. Related controls: ISO 27001:2022 A.5.17 (Authentication information); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "password.expiration"
},
{
"id": "fix:password.expiration:macos",
"kind": "fix",
"title": "Password expiration on macOS",
"text": "Password expiration on macOS. Why it matters: The baseline requires passwords to be changed within a set period, limiting how long a stolen password stays useful. Risk if missing: Low - A leaked password can stay valid indefinitely. Requirement: Passwords expire after 1..PASSWORD_MAX_AGE_DAYS days (0 in the baseline = expiry not required). How to fix on macOS: (1) Deploy a Passcode configuration profile with maxPINAgeInDays = 365. How to verify: Re-run the audit; Password expiration should be between 1 and 365 days. Related controls: ISO 27001:2022 A.5.17 (Authentication information); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "password.expiration"
},
{
"id": "fix:password.min_age:windows",
"kind": "fix",
"title": "Minimum password age on Windows",
"text": "Minimum password age on Windows. Why it matters: A minimum age stops users cycling through passwords immediately to get back to an old one. Risk if missing: Low - Without it, the password history rule can be bypassed. Requirement: Minimum age >= PASSWORD_MIN_AGE_DAYS days. macOS has no such setting (NotApplicable). How to fix on Windows: (1) Set Group Policy: Account Policies > Password Policy > Minimum password age = 1 day(s). (2) For a stand-alone device: net accounts /minpwage:1 How to verify: Re-run the audit; Minimum password age should read 1 day(s) or more. Related controls: ISO 27001:2022 A.5.17 (Authentication information); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "password.min_age"
},
{
"id": "fix:password.min_age:linux",
"kind": "fix",
"title": "Minimum password age on Linux",
"text": "Minimum password age on Linux. Why it matters: A minimum age stops users cycling through passwords immediately to get back to an old one. Risk if missing: Low - Without it, the password history rule can be bypassed. Requirement: Minimum age >= PASSWORD_MIN_AGE_DAYS days. macOS has no such setting (NotApplicable). How to fix on Linux: (1) Set PASS_MIN_DAYS 1 in /etc/login.defs and apply to existing accounts: chage --mindays 1 <user> How to verify: Re-run the audit; Minimum password age should read 1 day(s) or more. Related controls: ISO 27001:2022 A.5.17 (Authentication information); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "password.min_age"
},
{
"id": "fix:password.min_age:macos",
"kind": "fix",
"title": "Minimum password age on macOS",
"text": "Minimum password age on macOS. Why it matters: A minimum age stops users cycling through passwords immediately to get back to an old one. Risk if missing: Low - Without it, the password history rule can be bypassed. Requirement: Minimum age >= PASSWORD_MIN_AGE_DAYS days. macOS has no such setting (NotApplicable). How to fix on macOS: (1) macOS has no minimum password age setting; rely on password history instead. How to verify: Re-run the audit; Minimum password age should read 1 day(s) or more. Related controls: ISO 27001:2022 A.5.17 (Authentication information); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "password.min_age"
},
{
"id": "fix:password.complexity:windows",
"kind": "fix",
"title": "Password complexity on Windows",
"text": "Password complexity on Windows. Why it matters: Mixing character types makes passwords harder to guess. Risk if missing: Medium - Simple passwords are cracked quickly by dictionary attacks. Requirement: Complexity enforced (mixed character classes). How to fix on Windows: (1) Set Group Policy: Account Policies > Password Policy > Password must meet complexity requirements = Enabled. How to verify: Re-run the audit; Password complexity should be Compliant. Related controls: ISO 27001:2022 A.5.17 (Authentication information); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "password.complexity"
},
{
"id": "fix:password.complexity:linux",
"kind": "fix",
"title": "Password complexity on Linux",
"text": "Password complexity on Linux. Why it matters: Mixing character types makes passwords harder to guess. Risk if missing: Medium - Simple passwords are cracked quickly by dictionary attacks. Requirement: Complexity enforced (mixed character classes). How to fix on Linux: (1) Enable pam_pwquality and set minclass = 3 (or 4) in /etc/security/pwquality.conf. How to verify: Re-run the audit; Password complexity should be Compliant. Related controls: ISO 27001:2022 A.5.17 (Authentication information); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "password.complexity"
},
{
"id": "fix:password.complexity:macos",
"kind": "fix",
"title": "Password complexity on macOS",
"text": "Password complexity on macOS. Why it matters: Mixing character types makes passwords harder to guess. Risk if missing: Medium - Simple passwords are cracked quickly by dictionary attacks. Requirement: Complexity enforced (mixed character classes). How to fix on macOS: (1) Deploy a Passcode configuration profile with requireAlphanumeric = true (and minComplexChars = 1 if special characters are required). How to verify: Re-run the audit; Password complexity should be Compliant. Related controls: ISO 27001:2022 A.5.17 (Authentication information); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "password.complexity"
},
{
"id": "fix:lockout.threshold:windows",
"kind": "fix",
"title": "Account lockout threshold on Windows",
"text": "Account lockout threshold on Windows. Why it matters: Locking an account after a few wrong passwords stops online guessing. Risk if missing: Medium - Unlimited attempts allow brute-force attacks against local accounts. Requirement: Lockout after 1..LOCKOUT_THRESHOLD_MAX failed attempts (0 = never locks). How to fix on Windows: (1) Set Group Policy: Account Policies > Account Lockout Policy > Account lockout threshold = 5 invalid attempts (or fewer, not 0). (2) For a stand-alone device: net accounts /lockoutthreshold:5 How to verify: Re-run the audit; Account lockout threshold should be between 1 and 5. Related controls: ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "lockout.threshold"
},
{
"id": "fix:lockout.threshold:linux",
"kind": "fix",
"title": "Account lockout threshold on Linux",
"text": "Account lockout threshold on Linux. Why it matters: Locking an account after a few wrong passwords stops online guessing. Risk if missing: Medium - Unlimited attempts allow brute-force attacks against local accounts. Requirement: Lockout after 1..LOCKOUT_THRESHOLD_MAX failed attempts (0 = never locks). How to fix on Linux: (1) Enable pam_faillock in the PAM auth stack (RHEL: authselect enable-feature with-faillock; Debian/Ubuntu: add the preauth/authfail lines described in pam_faillock(8)). (2) Set deny = 5 in /etc/security/faillock.conf. How to verify: Re-run the audit; Account lockout threshold should be between 1 and 5. Related controls: ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "lockout.threshold"
},
{
"id": "fix:lockout.threshold:macos",
"kind": "fix",
"title": "Account lockout threshold on macOS",
"text": "Account lockout threshold on macOS. Why it matters: Locking an account after a few wrong passwords stops online guessing. Risk if missing: Medium - Unlimited attempts allow brute-force attacks against local accounts. Requirement: Lockout after 1..LOCKOUT_THRESHOLD_MAX failed attempts (0 = never locks). How to fix on macOS: (1) Deploy a Passcode configuration profile with maxFailedAttempts = 5. How to verify: Re-run the audit; Account lockout threshold should be between 1 and 5. Related controls: ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "lockout.threshold"
},
{
"id": "fix:lockout.duration:windows",
"kind": "fix",
"title": "Account lockout duration on Windows",
"text": "Account lockout duration on Windows. Why it matters: The lockout must last long enough to slow down repeated guessing. Risk if missing: Low - A short lockout lets attackers resume guessing almost at once. Requirement: Locked for >= LOCKOUT_DURATION_MIN_MINUTES minutes, or until an administrator unlocks. How to fix on Windows: (1) Set Group Policy: Account Lockout Policy > Account lockout duration = 15 minutes or more. (2) For a stand-alone device: net accounts /lockoutduration:15 How to verify: Re-run the audit; Account lockout duration should be 15 minutes or more. Related controls: ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "lockout.duration"
},
{
"id": "fix:lockout.duration:linux",
"kind": "fix",
"title": "Account lockout duration on Linux",
"text": "Account lockout duration on Linux. Why it matters: The lockout must last long enough to slow down repeated guessing. Risk if missing: Low - A short lockout lets attackers resume guessing almost at once. Requirement: Locked for >= LOCKOUT_DURATION_MIN_MINUTES minutes, or until an administrator unlocks. How to fix on Linux: (1) Set unlock_time = 900 (seconds) in /etc/security/faillock.conf. How to verify: Re-run the audit; Account lockout duration should be 15 minutes or more. Related controls: ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "lockout.duration"
},
{
"id": "fix:lockout.duration:macos",
"kind": "fix",
"title": "Account lockout duration on macOS",
"text": "Account lockout duration on macOS. Why it matters: The lockout must last long enough to slow down repeated guessing. Risk if missing: Low - A short lockout lets attackers resume guessing almost at once. Requirement: Locked for >= LOCKOUT_DURATION_MIN_MINUTES minutes, or until an administrator unlocks. How to fix on macOS: (1) Deploy a Passcode configuration profile with minutesUntilFailedLoginReset = 15. How to verify: Re-run the audit; Account lockout duration should be 15 minutes or more. Related controls: ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "lockout.duration"
},
{
"id": "fix:lockout.observation:windows",
"kind": "fix",
"title": "Lockout observation period on Windows",
"text": "Lockout observation period on Windows. Why it matters: Failed attempts must be counted over a long enough window to detect slow guessing. Risk if missing: Low - A short window lets attackers pace their guesses to avoid lockout. Requirement: Failed-attempt counter kept for >= LOCKOUT_OBSERVATION_MIN_MINUTES minutes. How to fix on Windows: (1) Set Group Policy: Account Lockout Policy > Reset account lockout counter after = 15 minutes or more. (2) For a stand-alone device: net accounts /lockoutwindow:15 How to verify: Re-run the audit; Lockout observation period should be 15 minutes or more. Related controls: ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "lockout.observation"
},
{
"id": "fix:lockout.observation:linux",
"kind": "fix",
"title": "Lockout observation period on Linux",
"text": "Lockout observation period on Linux. Why it matters: Failed attempts must be counted over a long enough window to detect slow guessing. Risk if missing: Low - A short window lets attackers pace their guesses to avoid lockout. Requirement: Failed-attempt counter kept for >= LOCKOUT_OBSERVATION_MIN_MINUTES minutes. How to fix on Linux: (1) Set fail_interval = 900 (seconds) in /etc/security/faillock.conf. How to verify: Re-run the audit; Lockout observation period should be 15 minutes or more. Related controls: ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "lockout.observation"
},
{
"id": "fix:lockout.observation:macos",
"kind": "fix",
"title": "Lockout observation period on macOS",
"text": "Lockout observation period on macOS. Why it matters: Failed attempts must be counted over a long enough window to detect slow guessing. Risk if missing: Low - A short window lets attackers pace their guesses to avoid lockout. Requirement: Failed-attempt counter kept for >= LOCKOUT_OBSERVATION_MIN_MINUTES minutes. How to fix on macOS: (1) On macOS the counter resets when the lockout ends; set minutesUntilFailedLoginReset = 15 in the Passcode profile. How to verify: Re-run the audit; Lockout observation period should be 15 minutes or more. Related controls: ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "lockout.observation"
},
{
"id": "fix:malware.antivirus:windows",
"kind": "fix",
"title": "Antivirus on Windows",
"text": "Antivirus on Windows. Why it matters: Anti-malware software detects and blocks known malicious files and behaviour. Risk if missing: High - Without working anti-malware, ransomware and info-stealers can run unchallenged. Requirement: An enabled, up-to-date antivirus product is present. Android: Google Play Protect scanning is on. How to fix on Windows: (1) Turn Microsoft Defender Antivirus back on (Windows Security > Virus & threat protection) or make sure the third-party product is installed, enabled and reporting to Security Center. How to verify: Re-run the audit; Antivirus should be Compliant. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "malware.antivirus"
},
{
"id": "fix:malware.antivirus:linux",
"kind": "fix",
"title": "Antivirus on Linux",
"text": "Antivirus on Linux. Why it matters: Anti-malware software detects and blocks known malicious files and behaviour. Risk if missing: High - Without working anti-malware, ransomware and info-stealers can run unchallenged. Requirement: An enabled, up-to-date antivirus product is present. Android: Google Play Protect scanning is on. How to fix on Linux: (1) Install an endpoint protection product, or ClamAV: apt install clamav clamav-daemon (RHEL: dnf install clamav clamd), then systemctl enable --now clamav-daemon. How to verify: Re-run the audit; Antivirus should be Compliant. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "malware.antivirus"
},
{
"id": "fix:malware.antivirus:macos",
"kind": "fix",
"title": "Antivirus on macOS",
"text": "Antivirus on macOS. Why it matters: Anti-malware software detects and blocks known malicious files and behaviour. Risk if missing: High - Without working anti-malware, ransomware and info-stealers can run unchallenged. Requirement: An enabled, up-to-date antivirus product is present. Android: Google Play Protect scanning is on. How to fix on macOS: (1) XProtect is built in; if it is missing or damaged, reinstall the latest macOS update. Add a managed endpoint protection product if your policy requires on-access scanning. How to verify: Re-run the audit; Antivirus should be Compliant. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "malware.antivirus"
},
{
"id": "fix:malware.antivirus:android",
"kind": "fix",
"title": "Google Play Protect on Android",
"text": "Google Play Protect on Android. Why it matters: Anti-malware software detects and blocks known malicious files and behaviour. Risk if missing: High - Without working anti-malware, ransomware and info-stealers can run unchallenged. Requirement: An enabled, up-to-date antivirus product is present. Android: Google Play Protect scanning is on. How to fix on Android: (1) Play Store › profile picture › Play Protect › Settings: turn on 'Scan apps with Play Protect'. How to verify: Re-run the audit; Antivirus should be Compliant. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "android",
"check": "malware.antivirus"
},
{
"id": "fix:malware.service:windows",
"kind": "fix",
"title": "Microsoft Defender Antimalware on Windows",
"text": "Microsoft Defender Antimalware on Windows. Why it matters: The malware protection service must be running for protection to work. Risk if missing: High - A stopped protection service leaves the device unprotected. Requirement: The platform malware protection service is running. How to fix on Windows: (1) Re-enable Microsoft Defender: check that no Group Policy sets 'Turn off Microsoft Defender Antivirus', then restart the device. How to verify: Re-run the audit; the malware protection service should be Compliant. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "malware.service"
},
{
"id": "fix:malware.service:linux",
"kind": "fix",
"title": "ClamAV malware protection service on Linux",
"text": "ClamAV malware protection service on Linux. Why it matters: The malware protection service must be running for protection to work. Risk if missing: High - A stopped protection service leaves the device unprotected. Requirement: The platform malware protection service is running. How to fix on Linux: (1) systemctl enable --now clamav-daemon (RHEL: clamd@scan). How to verify: Re-run the audit; the malware protection service should be Compliant. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "malware.service"
},
{
"id": "fix:malware.service:macos",
"kind": "fix",
"title": "Apple malware protection service on macOS",
"text": "Apple malware protection service on macOS. Why it matters: The malware protection service must be running for protection to work. Risk if missing: High - A stopped protection service leaves the device unprotected. Requirement: The platform malware protection service is running. How to fix on macOS: (1) Re-enable Gatekeeper: sudo spctl --master-enable. Keep 'Install Security Responses and system files' on in Software Update. How to verify: Re-run the audit; the malware protection service should be Compliant. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "malware.service"
},
{
"id": "fix:malware.realtime:windows",
"kind": "fix",
"title": "Real-time protection on Windows",
"text": "Real-time protection on Windows. Why it matters: Real-time protection scans files and processes as they are used. Risk if missing: High - Without it, malware is only found by scheduled scans, after it has run. Requirement: Defender real-time protection is on. How to fix on Windows: (1) Set-MpPreference -DisableRealtimeMonitoring $false, and remove any policy that disables real-time protection. How to verify: Re-run the audit; Real-time protection should be on. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "malware.realtime"
},
{
"id": "fix:malware.on_access:windows",
"kind": "fix",
"title": "On-access protection on Windows",
"text": "On-access protection on Windows. Why it matters: On-access scanning checks files when they are opened or written. Risk if missing: Medium - Malicious files can be opened before any scheduled scan finds them. Requirement: Files are scanned when opened. macOS: NotApplicable unless a third-party scanner provides it. How to fix on Windows: (1) Enable real-time protection in Microsoft Defender (on-access protection follows it). How to verify: Re-run the audit; On-access malware protection should be Compliant. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "malware.on_access"
},
{
"id": "fix:malware.on_access:linux",
"kind": "fix",
"title": "On-access malware protection on Linux",
"text": "On-access malware protection on Linux. Why it matters: On-access scanning checks files when they are opened or written. Risk if missing: Medium - Malicious files can be opened before any scheduled scan finds them. Requirement: Files are scanned when opened. macOS: NotApplicable unless a third-party scanner provides it. How to fix on Linux: (1) Configure OnAccessIncludePath in /etc/clamav/clamd.conf and enable clamonacc (systemctl enable --now clamav-clamonacc), or use an endpoint product with on-access scanning. How to verify: Re-run the audit; On-access malware protection should be Compliant. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "malware.on_access"
},
{
"id": "fix:malware.on_access:macos",
"kind": "fix",
"title": "On-access malware protection on macOS",
"text": "On-access malware protection on macOS. Why it matters: On-access scanning checks files when they are opened or written. Risk if missing: Medium - Malicious files can be opened before any scheduled scan finds them. Requirement: Files are scanned when opened. macOS: NotApplicable unless a third-party scanner provides it. How to fix on macOS: (1) Not provided by macOS itself; deploy a managed endpoint protection product if required. How to verify: Re-run the audit; On-access malware protection should be Compliant. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "malware.on_access"
},
{
"id": "fix:malware.tamper:windows",
"kind": "fix",
"title": "Tamper protection on Windows",
"text": "Tamper protection on Windows. Why it matters: Tamper protection stops malware or users switching off Defender. Risk if missing: Medium - Attackers commonly disable antivirus before deploying ransomware. Requirement: Defender tamper protection is on. How to fix on Windows: (1) Turn on Tamper Protection in Windows Security > Virus & threat protection settings, or centrally through Microsoft Intune / Defender for Endpoint (it cannot be set with PowerShell). How to verify: Re-run the audit; Tamper protection should be on. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "malware.tamper"
},
{
"id": "fix:malware.signatures:windows",
"kind": "fix",
"title": "Security intelligence on Windows",
"text": "Security intelligence on Windows. Why it matters: Anti-malware can only detect threats it knows about; signatures must be current. Risk if missing: High - Outdated signatures miss recent malware. Requirement: Signatures no older than SIGNATURE_MAX_AGE_DAYS (macOS XProtect: MACOS_XPROTECT_MAX_AGE_DAYS). How to fix on Windows: (1) Run Update-MpSignature and check that the device can reach Windows Update or your update server. How to verify: Re-run the audit; signatures should be within the allowed age. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "malware.signatures"
},
{
"id": "fix:malware.signatures:linux",
"kind": "fix",
"title": "Malware signatures on Linux",
"text": "Malware signatures on Linux. Why it matters: Anti-malware can only detect threats it knows about; signatures must be current. Risk if missing: High - Outdated signatures miss recent malware. Requirement: Signatures no older than SIGNATURE_MAX_AGE_DAYS (macOS XProtect: MACOS_XPROTECT_MAX_AGE_DAYS). How to fix on Linux: (1) systemctl enable --now clamav-freshclam, or run freshclam once to update now. How to verify: Re-run the audit; signatures should be within the allowed age. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "malware.signatures"
},
{
"id": "fix:malware.signatures:macos",
"kind": "fix",
"title": "Malware protection signatures on macOS",
"text": "Malware protection signatures on macOS. Why it matters: Anti-malware can only detect threats it knows about; signatures must be current. Risk if missing: High - Outdated signatures miss recent malware. Requirement: Signatures no older than SIGNATURE_MAX_AGE_DAYS (macOS XProtect: MACOS_XPROTECT_MAX_AGE_DAYS). How to fix on macOS: (1) Keep 'Install Security Responses and system files' on (Software Update > Automatic Updates); run softwareupdate --background to fetch now. How to verify: Re-run the audit; signatures should be within the allowed age. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "malware.signatures"
},
{
"id": "fix:malware.signature_updates:linux",
"kind": "fix",
"title": "Malware signature updates on Linux",
"text": "Malware signature updates on Linux. Why it matters: Signature updates must happen automatically so protection stays current without user action. Risk if missing: Medium - Manual updates are forgotten, leaving protection outdated. Requirement: Automatic signature/security-data updates are enabled. How to fix on Linux: (1) systemctl enable --now clamav-freshclam. How to verify: Re-run the audit; signature updates should be automatic. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "malware.signature_updates"
},
{
"id": "fix:malware.signature_updates:macos",
"kind": "fix",
"title": "Malware security updates on macOS",
"text": "Malware security updates on macOS. Why it matters: Signature updates must happen automatically so protection stays current without user action. Risk if missing: Medium - Manual updates are forgotten, leaving protection outdated. Requirement: Automatic signature/security-data updates are enabled. How to fix on macOS: (1) Turn on 'Install Security Responses and system files' in System Settings > General > Software Update > Automatic Updates, or set ConfigDataInstall and CriticalUpdateInstall to true by configuration profile. How to verify: Re-run the audit; signature updates should be automatic. Related controls: ISO 27001:2022 A.8.7 (Protection against malware); ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "malware.signature_updates"
},
{
"id": "fix:firewall.enabled:linux",
"kind": "fix",
"title": "Firewall on Linux",
"text": "Firewall on Linux. Why it matters: A host firewall blocks unwanted network connections to the device, especially on public networks. Risk if missing: High - Network services on the device are exposed to anyone on the same network. Requirement: A host firewall is active. How to fix on Linux: (1) Debian/Ubuntu: ufw default deny incoming; ufw default allow outgoing; ufw enable. RHEL: systemctl enable --now firewalld. How to verify: Re-run the audit; the firewall should be on. Related controls: ISO 27001:2022 A.8.20 (Networks security); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "firewall.enabled"
},
{
"id": "fix:firewall.enabled:macos",
"kind": "fix",
"title": "Firewall on macOS",
"text": "Firewall on macOS. Why it matters: A host firewall blocks unwanted network connections to the device, especially on public networks. Risk if missing: High - Network services on the device are exposed to anyone on the same network. Requirement: A host firewall is active. How to fix on macOS: (1) sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on, or enforce the firewall by configuration profile. How to verify: Re-run the audit; the firewall should be on. Related controls: ISO 27001:2022 A.8.20 (Networks security); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "firewall.enabled"
},
{
"id": "fix:firewall.inbound:linux",
"kind": "fix",
"title": "Firewall inbound policy on Linux",
"text": "Firewall inbound policy on Linux. Why it matters: Unsolicited inbound connections should be blocked unless a service is explicitly allowed. Risk if missing: High - Open inbound access lets attackers reach vulnerable services directly. Requirement: Unsolicited inbound traffic is blocked by default (macOS: firewall on with stealth mode). How to fix on Linux: (1) ufw default deny incoming (firewalld: keep the default zone target at default/REJECT). How to verify: Re-run the audit; the inbound policy should be block/deny. Related controls: ISO 27001:2022 A.8.20 (Networks security); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "firewall.inbound"
},
{
"id": "fix:firewall.inbound:macos",
"kind": "fix",
"title": "Firewall inbound policy on macOS",
"text": "Firewall inbound policy on macOS. Why it matters: Unsolicited inbound connections should be blocked unless a service is explicitly allowed. Risk if missing: High - Open inbound access lets attackers reach vulnerable services directly. Requirement: Unsolicited inbound traffic is blocked by default (macOS: firewall on with stealth mode). How to fix on macOS: (1) Turn on stealth mode: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on. How to verify: Re-run the audit; the inbound policy should be block/deny. Related controls: ISO 27001:2022 A.8.20 (Networks security); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "firewall.inbound"
},
{
"id": "fix:firewall.outbound:linux",
"kind": "fix",
"title": "Firewall outbound policy on Linux",
"text": "Firewall outbound policy on Linux. Why it matters: The baseline fixes the default outbound policy so that it is consistent across devices. Risk if missing: Low - A different outbound policy either breaks applications or deviates from the agreed design. Requirement: Default outbound policy equals FIREWALL_OUTBOUND. How to fix on Linux: (1) ufw default allow outgoing (or the equivalent nftables output policy). How to verify: Re-run the audit; the outbound policy should read allow. Related controls: ISO 27001:2022 A.8.20 (Networks security); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "firewall.outbound"
},
{
"id": "fix:firewall.outbound:macos",
"kind": "fix",
"title": "Firewall outbound policy on macOS",
"text": "Firewall outbound policy on macOS. Why it matters: The baseline fixes the default outbound policy so that it is consistent across devices. Risk if missing: Low - A different outbound policy either breaks applications or deviates from the agreed design. Requirement: Default outbound policy equals FIREWALL_OUTBOUND. How to fix on macOS: (1) The macOS application firewall does not filter outbound traffic; use a network filter product if outbound blocking is required. How to verify: Re-run the audit; the outbound policy should read allow. Related controls: ISO 27001:2022 A.8.20 (Networks security); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "firewall.outbound"
},
{
"id": "fix:firewall.domain.enabled:windows",
"kind": "fix",
"title": "Domain firewall on Windows",
"text": "Domain firewall on Windows. Why it matters: A host firewall blocks unwanted network connections to the device, especially on public networks. Risk if missing: High - Network services on the device are exposed to anyone on the same network. Requirement: Domain profile enabled. How to fix on Windows: (1) Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune. How to verify: Re-run the audit; the firewall should be on. Related controls: ISO 27001:2022 A.8.20 (Networks security); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "firewall.domain.enabled"
},
{
"id": "fix:firewall.domain.inbound:windows",
"kind": "fix",
"title": "Domain inbound on Windows",
"text": "Domain inbound on Windows. Why it matters: Unsolicited inbound connections should be blocked unless a service is explicitly allowed. Risk if missing: High - Open inbound access lets attackers reach vulnerable services directly. Requirement: Domain profile default inbound action is Block. How to fix on Windows: (1) Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block. How to verify: Re-run the audit; the inbound policy should be block/deny. Related controls: ISO 27001:2022 A.8.20 (Networks security); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "firewall.domain.inbound"
},
{
"id": "fix:firewall.domain.outbound:windows",
"kind": "fix",
"title": "Domain outbound on Windows",
"text": "Domain outbound on Windows. Why it matters: The baseline fixes the default outbound policy so that it is consistent across devices. Risk if missing: Low - A different outbound policy either breaks applications or deviates from the agreed design. Requirement: Domain profile default outbound action equals FIREWALL_OUTBOUND. How to fix on Windows: (1) Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultOutboundAction Allow. How to verify: Re-run the audit; the outbound policy should read allow. Related controls: ISO 27001:2022 A.8.20 (Networks security); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "firewall.domain.outbound"
},
{
"id": "fix:firewall.private.enabled:windows",
"kind": "fix",
"title": "Private firewall on Windows",
"text": "Private firewall on Windows. Why it matters: A host firewall blocks unwanted network connections to the device, especially on public networks. Risk if missing: High - Network services on the device are exposed to anyone on the same network. Requirement: Private profile enabled. How to fix on Windows: (1) Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune. How to verify: Re-run the audit; the firewall should be on. Related controls: ISO 27001:2022 A.8.20 (Networks security); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "firewall.private.enabled"
},
{
"id": "fix:firewall.private.inbound:windows",
"kind": "fix",
"title": "Private inbound on Windows",
"text": "Private inbound on Windows. Why it matters: Unsolicited inbound connections should be blocked unless a service is explicitly allowed. Risk if missing: High - Open inbound access lets attackers reach vulnerable services directly. Requirement: Private profile default inbound action is Block. How to fix on Windows: (1) Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block. How to verify: Re-run the audit; the inbound policy should be block/deny. Related controls: ISO 27001:2022 A.8.20 (Networks security); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "firewall.private.inbound"
},
{
"id": "fix:firewall.private.outbound:windows",
"kind": "fix",
"title": "Private outbound on Windows",
"text": "Private outbound on Windows. Why it matters: The baseline fixes the default outbound policy so that it is consistent across devices. Risk if missing: Low - A different outbound policy either breaks applications or deviates from the agreed design. Requirement: Private profile default outbound action equals FIREWALL_OUTBOUND. How to fix on Windows: (1) Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultOutboundAction Allow. How to verify: Re-run the audit; the outbound policy should read allow. Related controls: ISO 27001:2022 A.8.20 (Networks security); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "firewall.private.outbound"
},
{
"id": "fix:firewall.public.enabled:windows",
"kind": "fix",
"title": "Public firewall on Windows",
"text": "Public firewall on Windows. Why it matters: A host firewall blocks unwanted network connections to the device, especially on public networks. Risk if missing: High - Network services on the device are exposed to anyone on the same network. Requirement: Public profile enabled. How to fix on Windows: (1) Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True, or enforce it with Group Policy/Intune. How to verify: Re-run the audit; the firewall should be on. Related controls: ISO 27001:2022 A.8.20 (Networks security); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "firewall.public.enabled"
},
{
"id": "fix:firewall.public.inbound:windows",
"kind": "fix",
"title": "Public inbound on Windows",
"text": "Public inbound on Windows. Why it matters: Unsolicited inbound connections should be blocked unless a service is explicitly allowed. Risk if missing: High - Open inbound access lets attackers reach vulnerable services directly. Requirement: Public profile default inbound action is Block. How to fix on Windows: (1) Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction Block. How to verify: Re-run the audit; the inbound policy should be block/deny. Related controls: ISO 27001:2022 A.8.20 (Networks security); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "firewall.public.inbound"
},
{
"id": "fix:firewall.public.outbound:windows",
"kind": "fix",
"title": "Public outbound on Windows",
"text": "Public outbound on Windows. Why it matters: The baseline fixes the default outbound policy so that it is consistent across devices. Risk if missing: Low - A different outbound policy either breaks applications or deviates from the agreed design. Requirement: Public profile default outbound action equals FIREWALL_OUTBOUND. How to fix on Windows: (1) Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultOutboundAction Allow. How to verify: Re-run the audit; the outbound policy should read allow. Related controls: ISO 27001:2022 A.8.20 (Networks security); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "firewall.public.outbound"
},
{
"id": "fix:screen_lock.enabled:windows",
"kind": "fix",
"title": "Screen lock on Windows",
"text": "Screen lock on Windows. Why it matters: An idle device should lock itself so nobody can use it while the owner is away. Risk if missing: Medium - An unlocked, unattended device exposes all the user's data and accounts. Requirement: The screen locks when idle (Windows: machine inactivity limit or a password-protected screen saver). Phones: a passcode / PIN / password screen lock is set. How to fix on Windows: (1) Set Group Policy: Local Policies > Security Options > Interactive logon: Machine inactivity limit = 300 seconds, or enforce a password-protected screen saver by Group Policy/Intune. How to verify: Re-run the audit; Screen lock should be on. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.7.7 (Clear desk and clear screen); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "screen_lock.enabled"
},
{
"id": "fix:screen_lock.enabled:linux",
"kind": "fix",
"title": "Screen lock on Linux",
"text": "Screen lock on Linux. Why it matters: An idle device should lock itself so nobody can use it while the owner is away. Risk if missing: Medium - An unlocked, unattended device exposes all the user's data and accounts. Requirement: The screen locks when idle (Windows: machine inactivity limit or a password-protected screen saver). Phones: a passcode / PIN / password screen lock is set. How to fix on Linux: (1) For GNOME: gsettings set org.gnome.desktop.screensaver lock-enabled true, and enforce it for all users with a locked dconf setting in /etc/dconf/db/local.d/. How to verify: Re-run the audit; Screen lock should be on. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.7.7 (Clear desk and clear screen); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "screen_lock.enabled"
},
{
"id": "fix:screen_lock.enabled:macos",
"kind": "fix",
"title": "Screen lock on macOS",
"text": "Screen lock on macOS. Why it matters: An idle device should lock itself so nobody can use it while the owner is away. Risk if missing: Medium - An unlocked, unattended device exposes all the user's data and accounts. Requirement: The screen locks when idle (Windows: machine inactivity limit or a password-protected screen saver). Phones: a passcode / PIN / password screen lock is set. How to fix on macOS: (1) System Settings > Lock Screen: set the screen saver and display-off times and 'Require password' = Immediately, or enforce with a configuration profile. How to verify: Re-run the audit; Screen lock should be on. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.7.7 (Clear desk and clear screen); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "screen_lock.enabled"
},
{
"id": "fix:screen_lock.enabled:ios",
"kind": "fix",
"title": "Passcode on iPhone",
"text": "Passcode on iPhone. Why it matters: An idle device should lock itself so nobody can use it while the owner is away. Risk if missing: Medium - An unlocked, unattended device exposes all the user's data and accounts. Requirement: The screen locks when idle (Windows: machine inactivity limit or a password-protected screen saver). Phones: a passcode / PIN / password screen lock is set. How to fix on iPhone: (1) Settings › Face ID & Passcode › Turn Passcode On; for work phones the employer can require it with a configuration profile. How to verify: Re-run the audit; Screen lock should be on. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.7.7 (Clear desk and clear screen); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "ios",
"check": "screen_lock.enabled"
},
{
"id": "fix:screen_lock.enabled:android",
"kind": "fix",
"title": "Screen lock on Android",
"text": "Screen lock on Android. Why it matters: An idle device should lock itself so nobody can use it while the owner is away. Risk if missing: Medium - An unlocked, unattended device exposes all the user's data and accounts. Requirement: The screen locks when idle (Windows: machine inactivity limit or a password-protected screen saver). Phones: a passcode / PIN / password screen lock is set. How to fix on Android: (1) Settings › Security & privacy › Device unlock › Screen lock: choose PIN or Password. How to verify: Re-run the audit; Screen lock should be on. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.7.7 (Clear desk and clear screen); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "android",
"check": "screen_lock.enabled"
},
{
"id": "fix:screen_lock.timeout:windows",
"kind": "fix",
"title": "Screen lock timeout on Windows",
"text": "Screen lock timeout on Windows. Why it matters: The shorter the idle time before locking, the smaller the window for misuse. Risk if missing: Medium - A long or missing timeout leaves unattended devices open. Requirement: Idle time before lock (including any grace delay) is 1..SCREEN_LOCK_MAX_SECONDS seconds (baseline: 300 = 5 minutes). Phones: Auto-Lock / screen timeout. How to fix on Windows: (1) Set Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive logon: Machine inactivity limit = 300 seconds (or less). How to verify: Re-run the audit; Screen lock timeout should be 300 seconds or less. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.7.7 (Clear desk and clear screen); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "screen_lock.timeout"
},
{
"id": "fix:screen_lock.timeout:linux",
"kind": "fix",
"title": "Screen lock timeout on Linux",
"text": "Screen lock timeout on Linux. Why it matters: The shorter the idle time before locking, the smaller the window for misuse. Risk if missing: Medium - A long or missing timeout leaves unattended devices open. Requirement: Idle time before lock (including any grace delay) is 1..SCREEN_LOCK_MAX_SECONDS seconds (baseline: 300 = 5 minutes). Phones: Auto-Lock / screen timeout. How to fix on Linux: (1) gsettings set org.gnome.desktop.session idle-delay 300 and gsettings set org.gnome.desktop.screensaver lock-delay 0; enforce with locked dconf settings. How to verify: Re-run the audit; Screen lock timeout should be 300 seconds or less. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.7.7 (Clear desk and clear screen); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "screen_lock.timeout"
},
{
"id": "fix:screen_lock.timeout:macos",
"kind": "fix",
"title": "Screen lock timeout on macOS",
"text": "Screen lock timeout on macOS. Why it matters: The shorter the idle time before locking, the smaller the window for misuse. Risk if missing: Medium - A long or missing timeout leaves unattended devices open. Requirement: Idle time before lock (including any grace delay) is 1..SCREEN_LOCK_MAX_SECONDS seconds (baseline: 300 = 5 minutes). Phones: Auto-Lock / screen timeout. How to fix on macOS: (1) Set the screen saver to start within 5 minutes (idleTime in com.apple.screensaver) and require the password immediately, ideally by configuration profile. How to verify: Re-run the audit; Screen lock timeout should be 300 seconds or less. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.7.7 (Clear desk and clear screen); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "screen_lock.timeout"
},
{
"id": "fix:screen_lock.timeout:ios",
"kind": "fix",
"title": "Auto-Lock on iPhone",
"text": "Auto-Lock on iPhone. Why it matters: The shorter the idle time before locking, the smaller the window for misuse. Risk if missing: Medium - A long or missing timeout leaves unattended devices open. Requirement: Idle time before lock (including any grace delay) is 1..SCREEN_LOCK_MAX_SECONDS seconds (baseline: 300 = 5 minutes). Phones: Auto-Lock / screen timeout. How to fix on iPhone: (1) Settings › Display & Brightness › Auto-Lock: choose 5 minutes or less (not Never). How to verify: Re-run the audit; Screen lock timeout should be 300 seconds or less. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.7.7 (Clear desk and clear screen); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "ios",
"check": "screen_lock.timeout"
},
{
"id": "fix:screen_lock.timeout:android",
"kind": "fix",
"title": "Screen timeout on Android",
"text": "Screen timeout on Android. Why it matters: The shorter the idle time before locking, the smaller the window for misuse. Risk if missing: Medium - A long or missing timeout leaves unattended devices open. Requirement: Idle time before lock (including any grace delay) is 1..SCREEN_LOCK_MAX_SECONDS seconds (baseline: 300 = 5 minutes). Phones: Auto-Lock / screen timeout. How to fix on Android: (1) Settings › Display › Screen timeout: choose 5 minutes or less, and set 'Lock after screen timeout' to Immediately where the phone offers it. How to verify: Re-run the audit; Screen lock timeout should be 300 seconds or less. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.7.7 (Clear desk and clear screen); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "android",
"check": "screen_lock.timeout"
},
{
"id": "fix:screen_lock.password:windows",
"kind": "fix",
"title": "Screen lock password requirement on Windows",
"text": "Screen lock password requirement on Windows. Why it matters: Unlocking the screen must require the user's password. Risk if missing: Medium - A screen lock that needs no password does not protect anything. Requirement: A password is required to unlock (macOS: within 5 seconds of the screen locking). How to fix on Windows: (1) Set the machine inactivity limit by Group Policy (this always requires sign-in), or enable 'Password protect the screen saver' for users by Group Policy. How to verify: Re-run the audit; the password requirement should be Compliant. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.7.7 (Clear desk and clear screen); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "screen_lock.password"
},
{
"id": "fix:screen_lock.password:linux",
"kind": "fix",
"title": "Screen lock password requirement on Linux",
"text": "Screen lock password requirement on Linux. Why it matters: Unlocking the screen must require the user's password. Risk if missing: Medium - A screen lock that needs no password does not protect anything. Requirement: A password is required to unlock (macOS: within 5 seconds of the screen locking). How to fix on Linux: (1) Keep org.gnome.desktop.screensaver lock-enabled true and org.gnome.desktop.lockdown disable-lock-screen false. How to verify: Re-run the audit; the password requirement should be Compliant. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.7.7 (Clear desk and clear screen); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "screen_lock.password"
},
{
"id": "fix:screen_lock.password:macos",
"kind": "fix",
"title": "Screen lock password requirement on macOS",
"text": "Screen lock password requirement on macOS. Why it matters: Unlocking the screen must require the user's password. Risk if missing: Medium - A screen lock that needs no password does not protect anything. Requirement: A password is required to unlock (macOS: within 5 seconds of the screen locking). How to fix on macOS: (1) System Settings > Lock Screen > 'Require password after screen saver begins or display is turned off' = Immediately (askForPasswordDelay = 0 by profile). How to verify: Re-run the audit; the password requirement should be Compliant. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.7.7 (Clear desk and clear screen); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "screen_lock.password"
},
{
"id": "fix:mobile.passcode_strength:ios",
"kind": "fix",
"title": "Passcode strength on iPhone",
"text": "Passcode strength on iPhone. Why it matters: A short numeric code or a pattern can be guessed or seen over the user's shoulder; a longer code protects the data if the phone is lost. Risk if missing: Medium - A weak passcode lets someone who has the phone unlock it and read work data. Requirement: Passcode / PIN has at least MOBILE_PASSCODE_MIN_DIGITS digits, or is alphanumeric. Android pattern or swipe locks do not comply. How to fix on iPhone: (1) Settings › Face ID & Passcode › Change Passcode › Passcode Options: choose a 6-digit, custom numeric (7+ digits) or alphanumeric code. How to verify: Re-run the phone check; the passcode answer should be at least 6 digits or alphanumeric. Related controls: ISO 27001:2022 A.5.17 (Authentication information); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "ios",
"check": "mobile.passcode_strength"
},
{
"id": "fix:mobile.passcode_strength:android",
"kind": "fix",
"title": "Screen lock strength on Android",
"text": "Screen lock strength on Android. Why it matters: A short numeric code or a pattern can be guessed or seen over the user's shoulder; a longer code protects the data if the phone is lost. Risk if missing: Medium - A weak passcode lets someone who has the phone unlock it and read work data. Requirement: Passcode / PIN has at least MOBILE_PASSCODE_MIN_DIGITS digits, or is alphanumeric. Android pattern or swipe locks do not comply. How to fix on Android: (1) Settings › Security & privacy › Device unlock › Screen lock: choose a PIN of at least 6 digits or a password instead of a pattern. How to verify: Re-run the phone check; the passcode answer should be at least 6 digits or alphanumeric. Related controls: ISO 27001:2022 A.5.17 (Authentication information); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "android",
"check": "mobile.passcode_strength"
},
{
"id": "fix:mobile.jailbreak_root:ios",
"kind": "fix",
"title": "Not jailbroken on iPhone",
"text": "Not jailbroken on iPhone. Why it matters: Jailbreaking or rooting removes the operating system's app isolation and security checks. Risk if missing: High - Any app can then read other apps' data, including work email and files. Requirement: The phone is not jailbroken (iOS) or rooted / bootloader-unlocked (Android). How to fix on iPhone: (1) Restore the iPhone with the latest iOS (Settings › General › Transfer or Reset iPhone › Erase All Content and Settings, or restore through a computer), then restore data from a backup. How to verify: Re-run the phone check after restoring; the phone should be reported as not jailbroken / not rooted. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.8.7 (Protection against malware); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "ios",
"check": "mobile.jailbreak_root"
},
{
"id": "fix:mobile.jailbreak_root:android",
"kind": "fix",
"title": "Not rooted on Android",
"text": "Not rooted on Android. Why it matters: Jailbreaking or rooting removes the operating system's app isolation and security checks. Risk if missing: High - Any app can then read other apps' data, including work email and files. Requirement: The phone is not jailbroken (iOS) or rooted / bootloader-unlocked (Android). How to fix on Android: (1) Remove root and re-lock the bootloader by installing the phone maker's official firmware, or stop using the phone for work. How to verify: Re-run the phone check after restoring; the phone should be reported as not jailbroken / not rooted. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.8.7 (Protection against malware); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "android",
"check": "mobile.jailbreak_root"
},
{
"id": "fix:mobile.app_sources:ios",
"kind": "fix",
"title": "Apps only from the App Store on iPhone",
"text": "Apps only from the App Store on iPhone. Why it matters: Official app stores review apps for malware; apps from other sources skip those checks. Risk if missing: High - Side-loaded apps are a common way malware reaches phones. Requirement: Apps are installed only from the official store (no alternative marketplaces, web distribution or unknown sources). How to fix on iPhone: (1) Remove apps from alternative marketplaces or websites, and remove unknown profiles in Settings › General › VPN & Device Management; install work apps only from the App Store or the employer. How to verify: Re-run the phone check; apps should come only from the official store (or the employer). Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.8.7 (Protection against malware); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "ios",
"check": "mobile.app_sources"
},
{
"id": "fix:mobile.app_sources:android",
"kind": "fix",
"title": "Install unknown apps blocked on Android",
"text": "Install unknown apps blocked on Android. Why it matters: Official app stores review apps for malware; apps from other sources skip those checks. Risk if missing: High - Side-loaded apps are a common way malware reaches phones. Requirement: Apps are installed only from the official store (no alternative marketplaces, web distribution or unknown sources). How to fix on Android: (1) Settings › Apps › Special app access › Install unknown apps: set every app to Not allowed; uninstall apps that did not come from Google Play. How to verify: Re-run the phone check; apps should come only from the official store (or the employer). Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.8.7 (Protection against malware); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "android",
"check": "mobile.app_sources"
},
{
"id": "fix:mobile.usb_debugging:android",
"kind": "fix",
"title": "USB debugging off on Android",
"text": "USB debugging off on Android. Why it matters: USB debugging lets a connected computer install apps and read data without the usual checks. Risk if missing: Medium - Anyone who can plug the unlocked phone into a computer can copy data or install software. Requirement: Developer options / USB debugging are off. How to fix on Android: (1) Settings › System › Developer options: turn off USB debugging, or turn off Developer options completely. How to verify: Re-run the phone check; USB debugging should be off. Related controls: ISO 27001:2022 A.8.1 (User endpoint devices); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "android",
"check": "mobile.usb_debugging"
},
{
"id": "fix:mobile.find_my_device:ios",
"kind": "fix",
"title": "Find My iPhone on iPhone",
"text": "Find My iPhone on iPhone. Why it matters: Locating, locking and erasing a lost phone limits a personal data breach. Risk if missing: Medium - A lost phone cannot be wiped, so its data may have to be reported as a breach (GDPR Art. 33). Requirement: Find My iPhone / Find My Device is on, so a lost phone can be located, locked and erased. How to fix on iPhone: (1) Settings › [your name] › Find My › Find My iPhone: turn on, together with Send Last Location. How to verify: Re-run the phone check; Find My should be on. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience); GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident).",
"os": "ios",
"check": "mobile.find_my_device"
},
{
"id": "fix:mobile.find_my_device:android",
"kind": "fix",
"title": "Find My Device on Android",
"text": "Find My Device on Android. Why it matters: Locating, locking and erasing a lost phone limits a personal data breach. Risk if missing: Medium - A lost phone cannot be wiped, so its data may have to be reported as a breach (GDPR Art. 33). Requirement: Find My iPhone / Find My Device is on, so a lost phone can be located, locked and erased. How to fix on Android: (1) Settings › Google › All services › Find My Device (Find Hub): turn on, and make sure Location is on. How to verify: Re-run the phone check; Find My should be on. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience); GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident).",
"os": "android",
"check": "mobile.find_my_device"
},
{
"id": "fix:usb.device_access:windows",
"kind": "fix",
"title": "USB storage device access on Windows",
"text": "USB storage device access on Windows. Why it matters: Blocking USB mass storage devices completely is the strongest protection against data leaving on, or malware arriving from, removable drives. Risk if missing: Low - The device access setting differs from the organisation's agreed USB policy. Requirement: Whether USB mass storage devices can connect at all equals USB_DEVICE_ACCESS (allow/deny): driver, device-installation policy, USBGuard or MDM restriction. How to fix on Windows: (1) To block USB storage completely: Group Policy > Administrative Templates > System > Removable Storage Access > All Removable Storage classes: Deny all access = Enabled, or set the USBSTOR service Start value to 4. How to verify: Re-run the audit; USB storage device access should read allow. Related controls: ISO 27001:2022 A.7.10 (Storage media); ISO 27001:2022 A.8.12 (Data leakage prevention); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "usb.device_access"
},
{
"id": "fix:usb.device_access:linux",
"kind": "fix",
"title": "USB storage device access on Linux",
"text": "USB storage device access on Linux. Why it matters: Blocking USB mass storage devices completely is the strongest protection against data leaving on, or malware arriving from, removable drives. Risk if missing: Low - The device access setting differs from the organisation's agreed USB policy. Requirement: Whether USB mass storage devices can connect at all equals USB_DEVICE_ACCESS (allow/deny): driver, device-installation policy, USBGuard or MDM restriction. How to fix on Linux: (1) To block USB storage completely: echo 'install usb-storage /bin/false' > /etc/modprobe.d/usb-storage.conf, or enable USBGuard with ImplicitPolicyTarget=block. How to verify: Re-run the audit; USB storage device access should read allow. Related controls: ISO 27001:2022 A.7.10 (Storage media); ISO 27001:2022 A.8.12 (Data leakage prevention); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "usb.device_access"
},
{
"id": "fix:usb.device_access:macos",
"kind": "fix",
"title": "USB storage device access on macOS",
"text": "USB storage device access on macOS. Why it matters: Blocking USB mass storage devices completely is the strongest protection against data leaving on, or malware arriving from, removable drives. Risk if missing: Low - The device access setting differs from the organisation's agreed USB policy. Requirement: Whether USB mass storage devices can connect at all equals USB_DEVICE_ACCESS (allow/deny): driver, device-installation policy, USBGuard or MDM restriction. How to fix on macOS: (1) Block or allow external storage with your MDM (Restrictions / device control) or an endpoint DLP product. How to verify: Re-run the audit; USB storage device access should read allow. Related controls: ISO 27001:2022 A.7.10 (Storage media); ISO 27001:2022 A.8.12 (Data leakage prevention); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "usb.device_access"
},
{
"id": "fix:usb.read:windows",
"kind": "fix",
"title": "USB storage read on Windows",
"text": "USB storage read on Windows. Why it matters: The baseline sets whether USB storage may be read; reading lets malware and unapproved data enter. Risk if missing: Low - The setting differs from the organisation's agreed USB policy. Requirement: Effective USB storage read access equals USB_READ (allow/deny). How to fix on Windows: (1) Set Group Policy: Computer Configuration > Administrative Templates > System > Removable Storage Access > Removable Disks: Deny read access = Disabled. How to verify: Re-run the audit; USB storage read should read allow. Related controls: ISO 27001:2022 A.7.10 (Storage media); ISO 27001:2022 A.8.12 (Data leakage prevention); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "usb.read"
},
{
"id": "fix:usb.read:linux",
"kind": "fix",
"title": "USB storage read on Linux",
"text": "USB storage read on Linux. Why it matters: The baseline sets whether USB storage may be read; reading lets malware and unapproved data enter. Risk if missing: Low - The setting differs from the organisation's agreed USB policy. Requirement: Effective USB storage read access equals USB_READ (allow/deny). How to fix on Linux: (1) To block USB storage completely: echo 'install usb-storage /bin/false' > /etc/modprobe.d/usb-storage.conf, or use USBGuard. How to verify: Re-run the audit; USB storage read should read allow. Related controls: ISO 27001:2022 A.7.10 (Storage media); ISO 27001:2022 A.8.12 (Data leakage prevention); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "usb.read"
},
{
"id": "fix:usb.read:macos",
"kind": "fix",
"title": "USB storage read on macOS",
"text": "USB storage read on macOS. Why it matters: The baseline sets whether USB storage may be read; reading lets malware and unapproved data enter. Risk if missing: Low - The setting differs from the organisation's agreed USB policy. Requirement: Effective USB storage read access equals USB_READ (allow/deny). How to fix on macOS: (1) Restrict external storage with your MDM or an endpoint DLP product. How to verify: Re-run the audit; USB storage read should read allow. Related controls: ISO 27001:2022 A.7.10 (Storage media); ISO 27001:2022 A.8.12 (Data leakage prevention); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "usb.read"
},
{
"id": "fix:usb.write:windows",
"kind": "fix",
"title": "USB storage write on Windows",
"text": "USB storage write on Windows. Why it matters: Writing to USB drives is a common way for data to leave the organisation, often unencrypted. Risk if missing: Medium - Personal or confidential data can be copied to an unmanaged, unencrypted drive and lost. Requirement: Effective USB storage write access equals USB_WRITE (allow/deny). How to fix on Windows: (1) Set Group Policy: Administrative Templates > System > Removable Storage Access > Removable Disks: Deny write access = Enabled, or require BitLocker To Go ('Deny write access to removable drives not protected by BitLocker'). How to verify: Re-run the audit; USB storage write should read deny. Related controls: ISO 27001:2022 A.7.10 (Storage media); ISO 27001:2022 A.8.12 (Data leakage prevention); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "usb.write"
},
{
"id": "fix:usb.write:linux",
"kind": "fix",
"title": "USB storage write on Linux",
"text": "USB storage write on Linux. Why it matters: Writing to USB drives is a common way for data to leave the organisation, often unencrypted. Risk if missing: Medium - Personal or confidential data can be copied to an unmanaged, unencrypted drive and lost. Requirement: Effective USB storage write access equals USB_WRITE (allow/deny). How to fix on Linux: (1) Make USB storage read-only with a udev rule, or block it with USBGuard or the usb-storage modprobe rule. How to verify: Re-run the audit; USB storage write should read deny. Related controls: ISO 27001:2022 A.7.10 (Storage media); ISO 27001:2022 A.8.12 (Data leakage prevention); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "usb.write"
},
{
"id": "fix:usb.write:macos",
"kind": "fix",
"title": "USB storage write on macOS",
"text": "USB storage write on macOS. Why it matters: Writing to USB drives is a common way for data to leave the organisation, often unencrypted. Risk if missing: Medium - Personal or confidential data can be copied to an unmanaged, unencrypted drive and lost. Requirement: Effective USB storage write access equals USB_WRITE (allow/deny). How to fix on macOS: (1) Restrict external storage to read-only or deny it with your MDM or an endpoint DLP product. How to verify: Re-run the audit; USB storage write should read deny. Related controls: ISO 27001:2022 A.7.10 (Storage media); ISO 27001:2022 A.8.12 (Data leakage prevention); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "usb.write"
},
{
"id": "fix:admin.approved:windows",
"kind": "fix",
"title": "Approved IT administrator on Windows",
"text": "Approved IT administrator on Windows. Why it matters: A known, approved IT account should manage the device so that support does not depend on users' own admin rights. Risk if missing: Medium - Without an approved admin account, IT tends to rely on employees' accounts having admin rights. Requirement: At least one account listed in APPROVED_ADMINS is an enabled administrator. How to fix on Windows: (1) Add the approved IT administrator account (listed in APPROVED_ADMINS) to the local Administrators group, ideally managed with Windows LAPS or Intune. How to verify: Re-run the audit; Approved IT administrator should list the approved account. Related controls: ISO 27001:2022 A.8.2 (Privileged access rights); ISO 27001:2022 A.5.15 (Access control); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "admin.approved"
},
{
"id": "fix:admin.approved:linux",
"kind": "fix",
"title": "Approved IT administrator on Linux",
"text": "Approved IT administrator on Linux. Why it matters: A known, approved IT account should manage the device so that support does not depend on users' own admin rights. Risk if missing: Medium - Without an approved admin account, IT tends to rely on employees' accounts having admin rights. Requirement: At least one account listed in APPROVED_ADMINS is an enabled administrator. How to fix on Linux: (1) Add the approved IT account to the sudo (Debian/Ubuntu) or wheel (RHEL) group: usermod -aG sudo <account>. How to verify: Re-run the audit; Approved IT administrator should list the approved account. Related controls: ISO 27001:2022 A.8.2 (Privileged access rights); ISO 27001:2022 A.5.15 (Access control); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "admin.approved"
},
{
"id": "fix:admin.approved:macos",
"kind": "fix",
"title": "Approved IT administrator on macOS",
"text": "Approved IT administrator on macOS. Why it matters: A known, approved IT account should manage the device so that support does not depend on users' own admin rights. Risk if missing: Medium - Without an approved admin account, IT tends to rely on employees' accounts having admin rights. Requirement: At least one account listed in APPROVED_ADMINS is an enabled administrator. How to fix on macOS: (1) Create or promote the approved IT account: sudo dseditgroup -o edit -a <account> -t user admin, ideally managed by your MDM. How to verify: Re-run the audit; Approved IT administrator should list the approved account. Related controls: ISO 27001:2022 A.8.2 (Privileged access rights); ISO 27001:2022 A.5.15 (Access control); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "admin.approved"
},
{
"id": "fix:admin.unauthorized:windows",
"kind": "fix",
"title": "Unauthorized employee local administrator accounts on Windows",
"text": "Unauthorized employee local administrator accounts on Windows. Why it matters: Everyday user accounts with administrator rights let malware and mistakes change anything on the device. Risk if missing: High - Malware running as an administrator can disable protection, install persistence and steal credentials. Requirement: No administrator accounts other than APPROVED_ADMINS (and the disabled built-in Administrator on Windows). How to fix on Windows: (1) Remove the listed accounts from the local Administrators group: Remove-LocalGroupMember -SID S-1-5-32-544 -Member <account>; give elevation through an approved process (e.g. Windows LAPS, an endpoint privilege management tool). How to verify: Re-run the audit; Unauthorized administrator accounts should read none. Related controls: ISO 27001:2022 A.8.2 (Privileged access rights); ISO 27001:2022 A.5.18 (Access rights); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "admin.unauthorized"
},
{
"id": "fix:admin.unauthorized:linux",
"kind": "fix",
"title": "Unauthorized employee administrator accounts on Linux",
"text": "Unauthorized employee administrator accounts on Linux. Why it matters: Everyday user accounts with administrator rights let malware and mistakes change anything on the device. Risk if missing: High - Malware running as an administrator can disable protection, install persistence and steal credentials. Requirement: No administrator accounts other than APPROVED_ADMINS (and the disabled built-in Administrator on Windows). How to fix on Linux: (1) Remove the listed accounts from the sudo/wheel groups (gpasswd -d <account> sudo) and remove their entries from /etc/sudoers.d. How to verify: Re-run the audit; Unauthorized administrator accounts should read none. Related controls: ISO 27001:2022 A.8.2 (Privileged access rights); ISO 27001:2022 A.5.18 (Access rights); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "admin.unauthorized"
},
{
"id": "fix:admin.unauthorized:macos",
"kind": "fix",
"title": "Unauthorized employee administrator accounts on macOS",
"text": "Unauthorized employee administrator accounts on macOS. Why it matters: Everyday user accounts with administrator rights let malware and mistakes change anything on the device. Risk if missing: High - Malware running as an administrator can disable protection, install persistence and steal credentials. Requirement: No administrator accounts other than APPROVED_ADMINS (and the disabled built-in Administrator on Windows). How to fix on macOS: (1) Demote the listed accounts: sudo dseditgroup -o edit -d <account> -t user admin. How to verify: Re-run the audit; Unauthorized administrator accounts should read none. Related controls: ISO 27001:2022 A.8.2 (Privileged access rights); ISO 27001:2022 A.5.18 (Access rights); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "admin.unauthorized"
},
{
"id": "fix:encryption.feature:windows",
"kind": "fix",
"title": "BitLocker on Windows",
"text": "BitLocker on Windows. Why it matters: Full-disk encryption keeps data unreadable if the device is lost or stolen. Risk if missing: High - A lost unencrypted laptop is a personal data breach that may have to be reported. Requirement: BitLocker is turned on for the system drive. How to fix on Windows: (1) Turn on BitLocker for the system drive (Enable-BitLocker -MountPoint C: -EncryptionMethod XtsAes256 -TpmProtector), preferably through Intune or Group Policy with key backup. How to verify: Re-run the audit; Encryption should be Compliant. Related controls: ISO 27001:2022 A.8.24 (Use of cryptography); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption).",
"os": "windows",
"check": "encryption.feature"
},
{
"id": "fix:encryption.enabled:windows",
"kind": "fix",
"title": "Encryption on Windows",
"text": "Encryption on Windows. Why it matters: Full-disk encryption keeps data unreadable if the device is lost or stolen. Risk if missing: High - A lost unencrypted laptop is a personal data breach that may have to be reported. Requirement: The system disk is fully encrypted (BitLocker / LUKS / FileVault). Phones: iOS data protection is on when a passcode is set; Android 10+ encrypts by default. How to fix on Windows: (1) Turn on BitLocker for the system drive (Enable-BitLocker -MountPoint C: -EncryptionMethod XtsAes256 -TpmProtector), preferably through Intune or Group Policy with key backup. How to verify: Re-run the audit; Encryption should be Compliant. Related controls: ISO 27001:2022 A.8.24 (Use of cryptography); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption).",
"os": "windows",
"check": "encryption.enabled"
},
{
"id": "fix:encryption.enabled:linux",
"kind": "fix",
"title": "Encryption on Linux",
"text": "Encryption on Linux. Why it matters: Full-disk encryption keeps data unreadable if the device is lost or stolen. Risk if missing: High - A lost unencrypted laptop is a personal data breach that may have to be reported. Requirement: The system disk is fully encrypted (BitLocker / LUKS / FileVault). Phones: iOS data protection is on when a passcode is set; Android 10+ encrypts by default. How to fix on Linux: (1) Disk encryption (LUKS) is usually chosen at installation; plan a reinstall with encryption, or an offline re-encryption with cryptsetup reencrypt after a full backup. How to verify: Re-run the audit; Encryption should be Compliant. Related controls: ISO 27001:2022 A.8.24 (Use of cryptography); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption).",
"os": "linux",
"check": "encryption.enabled"
},
{
"id": "fix:encryption.enabled:macos",
"kind": "fix",
"title": "Encryption on macOS",
"text": "Encryption on macOS. Why it matters: Full-disk encryption keeps data unreadable if the device is lost or stolen. Risk if missing: High - A lost unencrypted laptop is a personal data breach that may have to be reported. Requirement: The system disk is fully encrypted (BitLocker / LUKS / FileVault). Phones: iOS data protection is on when a passcode is set; Android 10+ encrypts by default. How to fix on macOS: (1) Turn on FileVault (System Settings > Privacy & Security > FileVault, or sudo fdesetup enable), ideally enforced and escrowed by your MDM. How to verify: Re-run the audit; Encryption should be Compliant. Related controls: ISO 27001:2022 A.8.24 (Use of cryptography); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption).",
"os": "macos",
"check": "encryption.enabled"
},
{
"id": "fix:encryption.enabled:ios",
"kind": "fix",
"title": "Data protection (encryption) on iPhone",
"text": "Data protection (encryption) on iPhone. Why it matters: Full-disk encryption keeps data unreadable if the device is lost or stolen. Risk if missing: High - A lost unencrypted laptop is a personal data breach that may have to be reported. Requirement: The system disk is fully encrypted (BitLocker / LUKS / FileVault). Phones: iOS data protection is on when a passcode is set; Android 10+ encrypts by default. How to fix on iPhone: (1) Set a passcode (Settings › Face ID & Passcode): iOS data protection encrypts the phone once a passcode is set. How to verify: Re-run the audit; Encryption should be Compliant. Related controls: ISO 27001:2022 A.8.24 (Use of cryptography); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption).",
"os": "ios",
"check": "encryption.enabled"
},
{
"id": "fix:encryption.enabled:android",
"kind": "fix",
"title": "Device encryption on Android",
"text": "Device encryption on Android. Why it matters: Full-disk encryption keeps data unreadable if the device is lost or stolen. Risk if missing: High - A lost unencrypted laptop is a personal data breach that may have to be reported. Requirement: The system disk is fully encrypted (BitLocker / LUKS / FileVault). Phones: iOS data protection is on when a passcode is set; Android 10+ encrypts by default. How to fix on Android: (1) Update to a supported Android version (10 or later encrypts by default) or replace the phone; set a PIN or password screen lock. How to verify: Re-run the audit; Encryption should be Compliant. Related controls: ISO 27001:2022 A.8.24 (Use of cryptography); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption).",
"os": "android",
"check": "encryption.enabled"
},
{
"id": "fix:encryption.protection:windows",
"kind": "fix",
"title": "BitLocker protection on Windows",
"text": "BitLocker protection on Windows. Why it matters: Encryption only protects the data when it is active, fully applied and uses a strong cipher. Risk if missing: High - Suspended or partial encryption leaves data readable on a lost device. Requirement: Encryption protection is active (not suspended or in progress) with a strong cipher. How to fix on Windows: (1) Resume protection if it is suspended (Resume-BitLocker -MountPoint C:) and let encryption finish; use an AES-XTS method. How to verify: Re-run the audit; Disk encryption protection should be Compliant. Related controls: ISO 27001:2022 A.8.24 (Use of cryptography); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption).",
"os": "windows",
"check": "encryption.protection"
},
{
"id": "fix:encryption.protection:linux",
"kind": "fix",
"title": "Disk encryption protection on Linux",
"text": "Disk encryption protection on Linux. Why it matters: Encryption only protects the data when it is active, fully applied and uses a strong cipher. Risk if missing: High - Suspended or partial encryption leaves data readable on a lost device. Requirement: Encryption protection is active (not suspended or in progress) with a strong cipher. How to fix on Linux: (1) Use LUKS2 with aes-xts-plain64 and a 512-bit key (AES-256) for new installations; plan migration of weaker setups. How to verify: Re-run the audit; Disk encryption protection should be Compliant. Related controls: ISO 27001:2022 A.8.24 (Use of cryptography); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption).",
"os": "linux",
"check": "encryption.protection"
},
{
"id": "fix:encryption.protection:macos",
"kind": "fix",
"title": "Disk encryption protection on macOS",
"text": "Disk encryption protection on macOS. Why it matters: Encryption only protects the data when it is active, fully applied and uses a strong cipher. Risk if missing: High - Suspended or partial encryption leaves data readable on a lost device. Requirement: Encryption protection is active (not suspended or in progress) with a strong cipher. How to fix on macOS: (1) Let FileVault encryption finish; keep the Mac on power until fdesetup status reports FileVault is On without progress. How to verify: Re-run the audit; Disk encryption protection should be Compliant. Related controls: ISO 27001:2022 A.8.24 (Use of cryptography); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption).",
"os": "macos",
"check": "encryption.protection"
},
{
"id": "fix:encryption.recovery:windows",
"kind": "fix",
"title": "BitLocker recovery on Windows",
"text": "BitLocker recovery on Windows. Why it matters: A recovery key lets IT unlock the disk if the user forgets the password or the hardware changes. Risk if missing: Medium - Without a recovery key, an encrypted disk can become permanently unreadable. Requirement: A recovery key or second unlock method exists. How to fix on Windows: (1) Add a recovery password: Add-BitLockerKeyProtector -MountPoint C: -RecoveryPasswordProtector, and back it up to Entra ID (BackupToAAD-BitLockerKeyProtector) or Active Directory. How to verify: Re-run the audit; Disk encryption recovery should be Compliant. Related controls: ISO 27001:2022 A.8.24 (Use of cryptography); ISO 27001:2022 A.8.13 (Information backup); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption); GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident).",
"os": "windows",
"check": "encryption.recovery"
},
{
"id": "fix:encryption.recovery:linux",
"kind": "fix",
"title": "Disk encryption recovery on Linux",
"text": "Disk encryption recovery on Linux. Why it matters: A recovery key lets IT unlock the disk if the user forgets the password or the hardware changes. Risk if missing: Medium - Without a recovery key, an encrypted disk can become permanently unreadable. Requirement: A recovery key or second unlock method exists. How to fix on Linux: (1) Add a second key slot holding a recovery passphrase: cryptsetup luksAddKey <device>, and store it in your password vault. How to verify: Re-run the audit; Disk encryption recovery should be Compliant. Related controls: ISO 27001:2022 A.8.24 (Use of cryptography); ISO 27001:2022 A.8.13 (Information backup); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption); GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident).",
"os": "linux",
"check": "encryption.recovery"
},
{
"id": "fix:encryption.recovery:macos",
"kind": "fix",
"title": "Disk encryption recovery on macOS",
"text": "Disk encryption recovery on macOS. Why it matters: A recovery key lets IT unlock the disk if the user forgets the password or the hardware changes. Risk if missing: Medium - Without a recovery key, an encrypted disk can become permanently unreadable. Requirement: A recovery key or second unlock method exists. How to fix on macOS: (1) Create or rotate a personal recovery key (sudo fdesetup changerecovery -personal) and escrow it to your MDM. How to verify: Re-run the audit; Disk encryption recovery should be Compliant. Related controls: ISO 27001:2022 A.8.24 (Use of cryptography); ISO 27001:2022 A.8.13 (Information backup); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption); GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident).",
"os": "macos",
"check": "encryption.recovery"
},
{
"id": "fix:user.account_type:windows",
"kind": "fix",
"title": "Signed-in user account type on Windows",
"text": "Signed-in user account type on Windows. Why it matters: Day-to-day work under an administrator account lets any malware or mistake change the whole system. Risk if missing: High - Malware started by the signed-in user runs with full administrator rights. Requirement: The everyday signed-in user is a Standard account (not an administrator), unless listed in APPROVED_ADMINS. How to fix on Windows: (1) Make the signed-in user a Standard user (Settings > Accounts > Other users > Change account type, or Remove-LocalGroupMember -SID S-1-5-32-544 -Member <account>) and use a separate approved admin account or LAPS for elevation. How to verify: Re-run the audit; Signed-in user account type should read Standard. Related controls: ISO 27001:2022 A.8.2 (Privileged access rights); ISO 27001:2022 A.5.15 (Access control); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "user.account_type"
},
{
"id": "fix:user.account_type:linux",
"kind": "fix",
"title": "Signed-in user account type on Linux",
"text": "Signed-in user account type on Linux. Why it matters: Day-to-day work under an administrator account lets any malware or mistake change the whole system. Risk if missing: High - Malware started by the signed-in user runs with full administrator rights. Requirement: The everyday signed-in user is a Standard account (not an administrator), unless listed in APPROVED_ADMINS. How to fix on Linux: (1) Remove the signed-in user from sudo/wheel (gpasswd -d <account> sudo) and use a separate approved admin account. How to verify: Re-run the audit; Signed-in user account type should read Standard. Related controls: ISO 27001:2022 A.8.2 (Privileged access rights); ISO 27001:2022 A.5.15 (Access control); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "user.account_type"
},
{
"id": "fix:user.account_type:macos",
"kind": "fix",
"title": "Signed-in user account type on macOS",
"text": "Signed-in user account type on macOS. Why it matters: Day-to-day work under an administrator account lets any malware or mistake change the whole system. Risk if missing: High - Malware started by the signed-in user runs with full administrator rights. Requirement: The everyday signed-in user is a Standard account (not an administrator), unless listed in APPROVED_ADMINS. How to fix on macOS: (1) Make the signed-in user a Standard user (System Settings > Users & Groups, or sudo dseditgroup -o edit -d <account> -t user admin) and keep a separate approved admin account. How to verify: Re-run the audit; Signed-in user account type should read Standard. Related controls: ISO 27001:2022 A.8.2 (Privileged access rights); ISO 27001:2022 A.5.15 (Access control); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "user.account_type"
},
{
"id": "fix:vuln.pending_updates:windows",
"kind": "fix",
"title": "Pending security updates on Windows",
"text": "Pending security updates on Windows. Why it matters: Security updates that are offered but not installed leave known, published vulnerabilities open. Risk if missing: High - Attackers target published vulnerabilities quickly after the fix is released. Requirement: Security updates offered by the OS vendor but not yet installed <= MAX_PENDING_SECURITY_UPDATES. Phones: iOS is at the latest security release known to the vulnerability data; Android security patch level is at most MOBILE_PATCH_MAX_AGE_DAYS old. How to fix on Windows: (1) Install the pending updates now (Settings > Windows Update > Install all), restart if asked, and check that automatic updates are not paused. How to verify: Re-run the audit; pending security updates should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience); GDPR Art. 32(1)(d) (Security of processing: regular testing and evaluation).",
"os": "windows",
"check": "vuln.pending_updates"
},
{
"id": "fix:vuln.pending_updates:linux",
"kind": "fix",
"title": "Pending security updates on Linux",
"text": "Pending security updates on Linux. Why it matters: Security updates that are offered but not installed leave known, published vulnerabilities open. Risk if missing: High - Attackers target published vulnerabilities quickly after the fix is released. Requirement: Security updates offered by the OS vendor but not yet installed <= MAX_PENDING_SECURITY_UPDATES. Phones: iOS is at the latest security release known to the vulnerability data; Android security patch level is at most MOBILE_PATCH_MAX_AGE_DAYS old. How to fix on Linux: (1) Install pending security updates: apt update && apt upgrade (RHEL: dnf upgrade --security), then reboot if a new kernel was installed. How to verify: Re-run the audit; pending security updates should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience); GDPR Art. 32(1)(d) (Security of processing: regular testing and evaluation).",
"os": "linux",
"check": "vuln.pending_updates"
},
{
"id": "fix:vuln.pending_updates:macos",
"kind": "fix",
"title": "Pending security updates on macOS",
"text": "Pending security updates on macOS. Why it matters: Security updates that are offered but not installed leave known, published vulnerabilities open. Risk if missing: High - Attackers target published vulnerabilities quickly after the fix is released. Requirement: Security updates offered by the OS vendor but not yet installed <= MAX_PENDING_SECURITY_UPDATES. Phones: iOS is at the latest security release known to the vulnerability data; Android security patch level is at most MOBILE_PATCH_MAX_AGE_DAYS old. How to fix on macOS: (1) Install the pending updates: System Settings > General > Software Update, or softwareupdate -ia, then restart if asked. How to verify: Re-run the audit; pending security updates should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience); GDPR Art. 32(1)(d) (Security of processing: regular testing and evaluation).",
"os": "macos",
"check": "vuln.pending_updates"
},
{
"id": "fix:vuln.pending_updates:ios",
"kind": "fix",
"title": "iOS security updates on iPhone",
"text": "iOS security updates on iPhone. Why it matters: Security updates that are offered but not installed leave known, published vulnerabilities open. Risk if missing: High - Attackers target published vulnerabilities quickly after the fix is released. Requirement: Security updates offered by the OS vendor but not yet installed <= MAX_PENDING_SECURITY_UPDATES. Phones: iOS is at the latest security release known to the vulnerability data; Android security patch level is at most MOBILE_PATCH_MAX_AGE_DAYS old. How to fix on iPhone: (1) Settings › General › Software Update: install the latest iOS version offered. How to verify: Re-run the audit; pending security updates should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience); GDPR Art. 32(1)(d) (Security of processing: regular testing and evaluation).",
"os": "ios",
"check": "vuln.pending_updates"
},
{
"id": "fix:vuln.pending_updates:android",
"kind": "fix",
"title": "Android security update on Android",
"text": "Android security update on Android. Why it matters: Security updates that are offered but not installed leave known, published vulnerabilities open. Risk if missing: High - Attackers target published vulnerabilities quickly after the fix is released. Requirement: Security updates offered by the OS vendor but not yet installed <= MAX_PENDING_SECURITY_UPDATES. Phones: iOS is at the latest security release known to the vulnerability data; Android security patch level is at most MOBILE_PATCH_MAX_AGE_DAYS old. How to fix on Android: (1) Settings › System › Software updates (and Security & privacy › Updates): install the latest system and Google Play system updates. If the security patch stays older than 90 days because the maker no longer sends updates, replace the phone. How to verify: Re-run the audit; pending security updates should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience); GDPR Art. 32(1)(d) (Security of processing: regular testing and evaluation).",
"os": "android",
"check": "vuln.pending_updates"
},
{
"id": "fix:vuln.outdated_apps:windows",
"kind": "fix",
"title": "Outdated third-party applications on Windows",
"text": "Outdated third-party applications on Windows. Why it matters: Browsers, office suites, PDF readers and meeting apps are common attack targets and need updates like the OS. Risk if missing: Medium - Outdated applications contain known vulnerabilities that attackers exploit through documents and web pages. Requirement: Installed third-party applications with a newer version available <= MAX_OUTDATED_APPS (Windows: winget; macOS: app versions; Linux: snap/flatpak and packages). Phones: automatic app updates are on. How to fix on Windows: (1) Update the listed applications (winget upgrade --all, or each app's own updater) and manage updates centrally with Intune or a patch management tool. How to verify: Re-run the audit; outdated applications should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "vuln.outdated_apps"
},
{
"id": "fix:vuln.outdated_apps:linux",
"kind": "fix",
"title": "Outdated third-party applications on Linux",
"text": "Outdated third-party applications on Linux. Why it matters: Browsers, office suites, PDF readers and meeting apps are common attack targets and need updates like the OS. Risk if missing: Medium - Outdated applications contain known vulnerabilities that attackers exploit through documents and web pages. Requirement: Installed third-party applications with a newer version available <= MAX_OUTDATED_APPS (Windows: winget; macOS: app versions; Linux: snap/flatpak and packages). Phones: automatic app updates are on. How to fix on Linux: (1) Update packages and app stores: apt upgrade, snap refresh, flatpak update. How to verify: Re-run the audit; outdated applications should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "vuln.outdated_apps"
},
{
"id": "fix:vuln.outdated_apps:macos",
"kind": "fix",
"title": "Outdated third-party applications on macOS",
"text": "Outdated third-party applications on macOS. Why it matters: Browsers, office suites, PDF readers and meeting apps are common attack targets and need updates like the OS. Risk if missing: Medium - Outdated applications contain known vulnerabilities that attackers exploit through documents and web pages. Requirement: Installed third-party applications with a newer version available <= MAX_OUTDATED_APPS (Windows: winget; macOS: app versions; Linux: snap/flatpak and packages). Phones: automatic app updates are on. How to fix on macOS: (1) Update the listed applications from the App Store or their own updaters (or brew upgrade for Homebrew apps), and manage updates centrally with your MDM. How to verify: Re-run the audit; outdated applications should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "vuln.outdated_apps"
},
{
"id": "fix:vuln.outdated_apps:ios",
"kind": "fix",
"title": "App updates on iPhone",
"text": "App updates on iPhone. Why it matters: Browsers, office suites, PDF readers and meeting apps are common attack targets and need updates like the OS. Risk if missing: Medium - Outdated applications contain known vulnerabilities that attackers exploit through documents and web pages. Requirement: Installed third-party applications with a newer version available <= MAX_OUTDATED_APPS (Windows: winget; macOS: app versions; Linux: snap/flatpak and packages). Phones: automatic app updates are on. How to fix on iPhone: (1) Settings › App Store: turn on App Updates; then App Store › account picture › update all pending apps. How to verify: Re-run the audit; outdated applications should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "ios",
"check": "vuln.outdated_apps"
},
{
"id": "fix:vuln.outdated_apps:android",
"kind": "fix",
"title": "App updates on Android",
"text": "App updates on Android. Why it matters: Browsers, office suites, PDF readers and meeting apps are common attack targets and need updates like the OS. Risk if missing: Medium - Outdated applications contain known vulnerabilities that attackers exploit through documents and web pages. Requirement: Installed third-party applications with a newer version available <= MAX_OUTDATED_APPS (Windows: winget; macOS: app versions; Linux: snap/flatpak and packages). Phones: automatic app updates are on. How to fix on Android: (1) Play Store › profile picture › Settings › Network preferences › Auto-update apps: Over any network or Over Wi-Fi only; then Manage apps & device › Update all. How to verify: Re-run the audit; outdated applications should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "android",
"check": "vuln.outdated_apps"
},
{
"id": "fix:vuln.known_vulnerabilities:windows",
"kind": "fix",
"title": "Known vulnerabilities in installed software on Windows",
"text": "Known vulnerabilities in installed software on Windows. Why it matters: Installed software versions with published critical or high vulnerabilities give attackers a ready-made way in. Risk if missing: High - Critical and high vulnerabilities often allow remote code execution or privilege escalation. Requirement: Installed software versions matched against an offline copy of the OSV/NVD vulnerability data: critical or high vulnerabilities <= MAX_CRITICAL_HIGH_VULNERABILITIES. iOS: the iOS version is matched against NVD iOS/iPadOS records. How to fix on Windows: (1) Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use. (2) Use winget upgrade or the vendor's installer to reach a fixed version. How to verify: Re-run the audit; critical or high vulnerabilities should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "vuln.known_vulnerabilities"
},
{
"id": "fix:vuln.known_vulnerabilities:linux",
"kind": "fix",
"title": "Known vulnerabilities in installed software on Linux",
"text": "Known vulnerabilities in installed software on Linux. Why it matters: Installed software versions with published critical or high vulnerabilities give attackers a ready-made way in. Risk if missing: High - Critical and high vulnerabilities often allow remote code execution or privilege escalation. Requirement: Installed software versions matched against an offline copy of the OSV/NVD vulnerability data: critical or high vulnerabilities <= MAX_CRITICAL_HIGH_VULNERABILITIES. iOS: the iOS version is matched against NVD iOS/iPadOS records. How to fix on Linux: (1) Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use. (2) Use the package manager to reach a fixed version (apt / dnf / snap / flatpak). How to verify: Re-run the audit; critical or high vulnerabilities should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "vuln.known_vulnerabilities"
},
{
"id": "fix:vuln.known_vulnerabilities:macos",
"kind": "fix",
"title": "Known vulnerabilities in installed software on macOS",
"text": "Known vulnerabilities in installed software on macOS. Why it matters: Installed software versions with published critical or high vulnerabilities give attackers a ready-made way in. Risk if missing: High - Critical and high vulnerabilities often allow remote code execution or privilege escalation. Requirement: Installed software versions matched against an offline copy of the OSV/NVD vulnerability data: critical or high vulnerabilities <= MAX_CRITICAL_HIGH_VULNERABILITIES. iOS: the iOS version is matched against NVD iOS/iPadOS records. How to fix on macOS: (1) Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use. (2) Use the App Store, the vendor's updater or brew upgrade to reach a fixed version. How to verify: Re-run the audit; critical or high vulnerabilities should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "vuln.known_vulnerabilities"
},
{
"id": "fix:vuln.known_vulnerabilities:ios",
"kind": "fix",
"title": "Known vulnerabilities in iOS on iPhone",
"text": "Known vulnerabilities in iOS on iPhone. Why it matters: Installed software versions with published critical or high vulnerabilities give attackers a ready-made way in. Risk if missing: High - Critical and high vulnerabilities often allow remote code execution or privilege escalation. Requirement: Installed software versions matched against an offline copy of the OSV/NVD vulnerability data: critical or high vulnerabilities <= MAX_CRITICAL_HIGH_VULNERABILITIES. iOS: the iOS version is matched against NVD iOS/iPadOS records. How to fix on iPhone: (1) Update or remove each listed software package to a version without the listed vulnerabilities; where no fix exists yet, apply the vendor's workaround or restrict the software's use. (2) Settings › General › Software Update: install the newest iOS version; if the iPhone cannot run a version without the listed vulnerabilities, replace it. How to verify: Re-run the audit; critical or high vulnerabilities should be 0 or fewer. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "ios",
"check": "vuln.known_vulnerabilities"
},
{
"id": "fix:gdpr.auto_updates:windows",
"kind": "fix",
"title": "Automatic security updates on Windows",
"text": "Automatic security updates on Windows. Why it matters: Security fixes must be installed automatically so that known vulnerabilities are closed quickly. Risk if missing: High - Unpatched devices are the most common way attackers get in. Requirement: Security updates are downloaded and installed automatically. How to fix on Windows: (1) Set Group Policy: Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates = 4 (auto download and schedule the install), or use Windows Update for Business / Intune; make sure the Windows Update service is not disabled. How to verify: Re-run the audit; Automatic security updates should be Compliant. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "gdpr.auto_updates"
},
{
"id": "fix:gdpr.auto_updates:linux",
"kind": "fix",
"title": "Automatic security updates on Linux",
"text": "Automatic security updates on Linux. Why it matters: Security fixes must be installed automatically so that known vulnerabilities are closed quickly. Risk if missing: High - Unpatched devices are the most common way attackers get in. Requirement: Security updates are downloaded and installed automatically. How to fix on Linux: (1) Debian/Ubuntu: apt install unattended-upgrades && dpkg-reconfigure -plow unattended-upgrades. RHEL: dnf install dnf-automatic && systemctl enable --now dnf-automatic-install.timer. How to verify: Re-run the audit; Automatic security updates should be Compliant. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "gdpr.auto_updates"
},
{
"id": "fix:gdpr.auto_updates:macos",
"kind": "fix",
"title": "Automatic security updates on macOS",
"text": "Automatic security updates on macOS. Why it matters: Security fixes must be installed automatically so that known vulnerabilities are closed quickly. Risk if missing: High - Unpatched devices are the most common way attackers get in. Requirement: Security updates are downloaded and installed automatically. How to fix on macOS: (1) Turn on all options in System Settings > General > Software Update > Automatic Updates, or enforce them with a configuration profile (AutomaticallyInstallMacOSUpdates = true). How to verify: Re-run the audit; Automatic security updates should be Compliant. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "gdpr.auto_updates"
},
{
"id": "fix:gdpr.auto_updates:ios",
"kind": "fix",
"title": "Automatic iOS updates on iPhone",
"text": "Automatic iOS updates on iPhone. Why it matters: Security fixes must be installed automatically so that known vulnerabilities are closed quickly. Risk if missing: High - Unpatched devices are the most common way attackers get in. Requirement: Security updates are downloaded and installed automatically. How to fix on iPhone: (1) Settings › General › Software Update › Automatic Updates: turn on iOS Updates Download and Install, and Security Responses & System Files. How to verify: Re-run the audit; Automatic security updates should be Compliant. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "ios",
"check": "gdpr.auto_updates"
},
{
"id": "fix:gdpr.auto_updates:android",
"kind": "fix",
"title": "Automatic system updates on Android",
"text": "Automatic system updates on Android. Why it matters: Security fixes must be installed automatically so that known vulnerabilities are closed quickly. Risk if missing: High - Unpatched devices are the most common way attackers get in. Requirement: Security updates are downloaded and installed automatically. How to fix on Android: (1) Settings › System › Software updates: turn on automatic download (names vary by phone maker). How to verify: Re-run the audit; Automatic security updates should be Compliant. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "android",
"check": "gdpr.auto_updates"
},
{
"id": "fix:gdpr.updates_recent:windows",
"kind": "fix",
"title": "Security updates installed recently on Windows",
"text": "Security updates installed recently on Windows. Why it matters: Recent installs show that patching is actually happening, not only configured. Risk if missing: High - A device not updated for a long time is likely missing critical security fixes. Requirement: Last successful update/package change within UPDATES_MAX_AGE_DAYS days. How to fix on Windows: (1) Run Windows Update now (Settings > Windows Update > Check for updates) and investigate why updates stopped (paused updates, broken update service, metered connection). How to verify: Re-run the audit; the last update should be within 30 days. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience); GDPR Art. 32(1)(d) (Security of processing: regular testing and evaluation).",
"os": "windows",
"check": "gdpr.updates_recent"
},
{
"id": "fix:gdpr.updates_recent:linux",
"kind": "fix",
"title": "Security updates installed recently on Linux",
"text": "Security updates installed recently on Linux. Why it matters: Recent installs show that patching is actually happening, not only configured. Risk if missing: High - A device not updated for a long time is likely missing critical security fixes. Requirement: Last successful update/package change within UPDATES_MAX_AGE_DAYS days. How to fix on Linux: (1) Run apt update && apt upgrade (RHEL: dnf upgrade) and check the automatic update logs for errors. How to verify: Re-run the audit; the last update should be within 30 days. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience); GDPR Art. 32(1)(d) (Security of processing: regular testing and evaluation).",
"os": "linux",
"check": "gdpr.updates_recent"
},
{
"id": "fix:gdpr.updates_recent:macos",
"kind": "fix",
"title": "Security updates installed recently on macOS",
"text": "Security updates installed recently on macOS. Why it matters: Recent installs show that patching is actually happening, not only configured. Risk if missing: High - A device not updated for a long time is likely missing critical security fixes. Requirement: Last successful update/package change within UPDATES_MAX_AGE_DAYS days. How to fix on macOS: (1) Install pending updates (System Settings > General > Software Update, or softwareupdate -ia). How to verify: Re-run the audit; the last update should be within 30 days. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience); GDPR Art. 32(1)(d) (Security of processing: regular testing and evaluation).",
"os": "macos",
"check": "gdpr.updates_recent"
},
{
"id": "fix:gdpr.os_supported:windows",
"kind": "fix",
"title": "Supported operating system version on Windows",
"text": "Supported operating system version on Windows. Why it matters: An operating system that no longer receives security updates cannot be kept secure. Risk if missing: High - New vulnerabilities in an unsupported OS are never fixed. Requirement: The OS version still receives security updates (minimums in the baseline). Phones: IOS_MIN_MAJOR / ANDROID_MIN_MAJOR. How to fix on Windows: (1) Upgrade to a supported Windows 11 release (build 22631 or later), or replace hardware that cannot run it. How to verify: Re-run the audit; Supported operating system version should be Compliant. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "gdpr.os_supported"
},
{
"id": "fix:gdpr.os_supported:linux",
"kind": "fix",
"title": "Supported operating system version on Linux",
"text": "Supported operating system version on Linux. Why it matters: An operating system that no longer receives security updates cannot be kept secure. Risk if missing: High - New vulnerabilities in an unsupported OS are never fixed. Requirement: The OS version still receives security updates (minimums in the baseline). Phones: IOS_MIN_MAJOR / ANDROID_MIN_MAJOR. How to fix on Linux: (1) Upgrade to a supported release (e.g. Ubuntu 22.04 or later) or enrol in extended security maintenance. How to verify: Re-run the audit; Supported operating system version should be Compliant. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "gdpr.os_supported"
},
{
"id": "fix:gdpr.os_supported:macos",
"kind": "fix",
"title": "Supported operating system version on macOS",
"text": "Supported operating system version on macOS. Why it matters: An operating system that no longer receives security updates cannot be kept secure. Risk if missing: High - New vulnerabilities in an unsupported OS are never fixed. Requirement: The OS version still receives security updates (minimums in the baseline). Phones: IOS_MIN_MAJOR / ANDROID_MIN_MAJOR. How to fix on macOS: (1) Upgrade to macOS 14 or later, or replace Macs that cannot run a supported version. How to verify: Re-run the audit; Supported operating system version should be Compliant. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "gdpr.os_supported"
},
{
"id": "fix:gdpr.os_supported:ios",
"kind": "fix",
"title": "Supported operating system version on iPhone",
"text": "Supported operating system version on iPhone. Why it matters: An operating system that no longer receives security updates cannot be kept secure. Risk if missing: High - New vulnerabilities in an unsupported OS are never fixed. Requirement: The OS version still receives security updates (minimums in the baseline). Phones: IOS_MIN_MAJOR / ANDROID_MIN_MAJOR. How to fix on iPhone: (1) Update to iOS 18 or later in Settings › General › Software Update; if the iPhone cannot run it, replace the iPhone. How to verify: Re-run the audit; Supported operating system version should be Compliant. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "ios",
"check": "gdpr.os_supported"
},
{
"id": "fix:gdpr.os_supported:android",
"kind": "fix",
"title": "Supported operating system version on Android",
"text": "Supported operating system version on Android. Why it matters: An operating system that no longer receives security updates cannot be kept secure. Risk if missing: High - New vulnerabilities in an unsupported OS are never fixed. Requirement: The OS version still receives security updates (minimums in the baseline). Phones: IOS_MIN_MAJOR / ANDROID_MIN_MAJOR. How to fix on Android: (1) Update to Android 13 or later in Settings › System › Software updates; if the maker no longer offers it, replace the phone. How to verify: Re-run the audit; Supported operating system version should be Compliant. Related controls: ISO 27001:2022 A.8.8 (Management of technical vulnerabilities); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "android",
"check": "gdpr.os_supported"
},
{
"id": "fix:gdpr.security_logging:windows",
"kind": "fix",
"title": "Security event logging on Windows",
"text": "Security event logging on Windows. Why it matters: Logon and account-change events are needed to detect and investigate a breach within the 72-hour GDPR deadline. Risk if missing: Medium - Without these logs, a breach cannot be scoped and the notification decision becomes guesswork. Requirement: Logon and account-change events are recorded (Windows audit policy, Linux auditd, macOS unified log). How to fix on Windows: (1) Enable auditing: auditpol /set /subcategory:{0CCE9215-69AE-11D9-BED3-505054503030} /success:enable /failure:enable (Logon) and auditpol /set /subcategory:{0CCE9235-69AE-11D9-BED3-505054503030} /success:enable /failure:enable (User Account Management), or set the Advanced Audit Policy by Group Policy. How to verify: Re-run the audit; Security event logging should be Compliant. Related controls: ISO 27001:2022 A.8.15 (Logging); GDPR Art. 32(1)(d) (Security of processing: regular testing and evaluation); GDPR Art. 33 (Notification of a personal data breach to the supervisory authority).",
"os": "windows",
"check": "gdpr.security_logging"
},
{
"id": "fix:gdpr.security_logging:linux",
"kind": "fix",
"title": "Security event logging on Linux",
"text": "Security event logging on Linux. Why it matters: Logon and account-change events are needed to detect and investigate a breach within the 72-hour GDPR deadline. Risk if missing: Medium - Without these logs, a breach cannot be scoped and the notification decision becomes guesswork. Requirement: Logon and account-change events are recorded (Windows audit policy, Linux auditd, macOS unified log). How to fix on Linux: (1) Install and start auditd (apt install auditd; systemctl enable --now auditd) and keep the journal persistent (Storage=persistent in /etc/systemd/journald.conf). How to verify: Re-run the audit; Security event logging should be Compliant. Related controls: ISO 27001:2022 A.8.15 (Logging); GDPR Art. 32(1)(d) (Security of processing: regular testing and evaluation); GDPR Art. 33 (Notification of a personal data breach to the supervisory authority).",
"os": "linux",
"check": "gdpr.security_logging"
},
{
"id": "fix:gdpr.security_logging:macos",
"kind": "fix",
"title": "Security event logging on macOS",
"text": "Security event logging on macOS. Why it matters: Logon and account-change events are needed to detect and investigate a breach within the 72-hour GDPR deadline. Risk if missing: Medium - Without these logs, a breach cannot be scoped and the notification decision becomes guesswork. Requirement: Logon and account-change events are recorded (Windows audit policy, Linux auditd, macOS unified log). How to fix on macOS: (1) Unified logging is built in; forward security logs to your log platform if long retention is required. How to verify: Re-run the audit; Security event logging should be Compliant. Related controls: ISO 27001:2022 A.8.15 (Logging); GDPR Art. 32(1)(d) (Security of processing: regular testing and evaluation); GDPR Art. 33 (Notification of a personal data breach to the supervisory authority).",
"os": "macos",
"check": "gdpr.security_logging"
},
{
"id": "fix:gdpr.time_sync:windows",
"kind": "fix",
"title": "Time synchronisation on Windows",
"text": "Time synchronisation on Windows. Why it matters: Accurate clocks are needed to put events in the right order during an investigation. Risk if missing: Low - Wrong timestamps make incident timelines unreliable. Requirement: The clock is synchronised from a time server. How to fix on Windows: (1) w32tm /config /syncfromflags:manual /manualpeerlist:\"pool.ntp.org\" /update (domain members sync from the domain automatically); make sure the Windows Time service is not disabled. How to verify: Re-run the audit; Time synchronisation should be Compliant. Related controls: ISO 27001:2022 A.8.17 (Clock synchronization); GDPR Art. 33 (Notification of a personal data breach to the supervisory authority).",
"os": "windows",
"check": "gdpr.time_sync"
},
{
"id": "fix:gdpr.time_sync:linux",
"kind": "fix",
"title": "Time synchronisation on Linux",
"text": "Time synchronisation on Linux. Why it matters: Accurate clocks are needed to put events in the right order during an investigation. Risk if missing: Low - Wrong timestamps make incident timelines unreliable. Requirement: The clock is synchronised from a time server. How to fix on Linux: (1) timedatectl set-ntp true (or enable chronyd). How to verify: Re-run the audit; Time synchronisation should be Compliant. Related controls: ISO 27001:2022 A.8.17 (Clock synchronization); GDPR Art. 33 (Notification of a personal data breach to the supervisory authority).",
"os": "linux",
"check": "gdpr.time_sync"
},
{
"id": "fix:gdpr.time_sync:macos",
"kind": "fix",
"title": "Time synchronisation on macOS",
"text": "Time synchronisation on macOS. Why it matters: Accurate clocks are needed to put events in the right order during an investigation. Risk if missing: Low - Wrong timestamps make incident timelines unreliable. Requirement: The clock is synchronised from a time server. How to fix on macOS: (1) sudo systemsetup -setusingnetworktime on. How to verify: Re-run the audit; Time synchronisation should be Compliant. Related controls: ISO 27001:2022 A.8.17 (Clock synchronization); GDPR Art. 33 (Notification of a personal data breach to the supervisory authority).",
"os": "macos",
"check": "gdpr.time_sync"
},
{
"id": "fix:gdpr.time_sync:ios",
"kind": "fix",
"title": "Date & time set automatically on iPhone",
"text": "Date & time set automatically on iPhone. Why it matters: Accurate clocks are needed to put events in the right order during an investigation. Risk if missing: Low - Wrong timestamps make incident timelines unreliable. Requirement: The clock is synchronised from a time server. How to fix on iPhone: (1) Settings › General › Date & Time: turn on Set Automatically. How to verify: Re-run the audit; Time synchronisation should be Compliant. Related controls: ISO 27001:2022 A.8.17 (Clock synchronization); GDPR Art. 33 (Notification of a personal data breach to the supervisory authority).",
"os": "ios",
"check": "gdpr.time_sync"
},
{
"id": "fix:gdpr.time_sync:android",
"kind": "fix",
"title": "Date & time set automatically on Android",
"text": "Date & time set automatically on Android. Why it matters: Accurate clocks are needed to put events in the right order during an investigation. Risk if missing: Low - Wrong timestamps make incident timelines unreliable. Requirement: The clock is synchronised from a time server. How to fix on Android: (1) Settings › System › Date & time: turn on Set time automatically. How to verify: Re-run the audit; Time synchronisation should be Compliant. Related controls: ISO 27001:2022 A.8.17 (Clock synchronization); GDPR Art. 33 (Notification of a personal data breach to the supervisory authority).",
"os": "android",
"check": "gdpr.time_sync"
},
{
"id": "fix:gdpr.backup_configured:windows",
"kind": "fix",
"title": "Backup configured on Windows",
"text": "Backup configured on Windows. Why it matters: Backups make it possible to restore personal data after loss, theft, failure or ransomware. Risk if missing: High - Data that exists only on this device is lost if the device fails or is encrypted by ransomware. Requirement: A backup solution is configured for user data. How to fix on Windows: (1) Back up user folders with OneDrive Known Folder Move (Group Policy/Intune), File History, or the organisation's backup agent. How to verify: Re-run the audit; Backup configured should be Compliant. Related controls: ISO 27001:2022 A.8.13 (Information backup); GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident).",
"os": "windows",
"check": "gdpr.backup_configured"
},
{
"id": "fix:gdpr.backup_configured:linux",
"kind": "fix",
"title": "Backup configured on Linux",
"text": "Backup configured on Linux. Why it matters: Backups make it possible to restore personal data after loss, theft, failure or ransomware. Risk if missing: High - Data that exists only on this device is lost if the device fails or is encrypted by ransomware. Requirement: A backup solution is configured for user data. How to fix on Linux: (1) Set up scheduled backups of /home with Deja Dup, restic or borg (or Timeshift for system snapshots plus a data backup). How to verify: Re-run the audit; Backup configured should be Compliant. Related controls: ISO 27001:2022 A.8.13 (Information backup); GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident).",
"os": "linux",
"check": "gdpr.backup_configured"
},
{
"id": "fix:gdpr.backup_configured:macos",
"kind": "fix",
"title": "Backup configured on macOS",
"text": "Backup configured on macOS. Why it matters: Backups make it possible to restore personal data after loss, theft, failure or ransomware. Risk if missing: High - Data that exists only on this device is lost if the device fails or is encrypted by ransomware. Requirement: A backup solution is configured for user data. How to fix on macOS: (1) Configure Time Machine (tmutil setdestination) or the organisation's backup agent. How to verify: Re-run the audit; Backup configured should be Compliant. Related controls: ISO 27001:2022 A.8.13 (Information backup); GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident).",
"os": "macos",
"check": "gdpr.backup_configured"
},
{
"id": "fix:gdpr.backup_configured:ios",
"kind": "fix",
"title": "iCloud Backup on iPhone",
"text": "iCloud Backup on iPhone. Why it matters: Backups make it possible to restore personal data after loss, theft, failure or ransomware. Risk if missing: High - Data that exists only on this device is lost if the device fails or is encrypted by ransomware. Requirement: A backup solution is configured for user data. How to fix on iPhone: (1) Settings › [your name] › iCloud › iCloud Backup: turn on, or use the employer's approved backup; keep work data only in company-approved apps. How to verify: Re-run the audit; Backup configured should be Compliant. Related controls: ISO 27001:2022 A.8.13 (Information backup); GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident).",
"os": "ios",
"check": "gdpr.backup_configured"
},
{
"id": "fix:gdpr.backup_configured:android",
"kind": "fix",
"title": "Google backup on Android",
"text": "Google backup on Android. Why it matters: Backups make it possible to restore personal data after loss, theft, failure or ransomware. Risk if missing: High - Data that exists only on this device is lost if the device fails or is encrypted by ransomware. Requirement: A backup solution is configured for user data. How to fix on Android: (1) Settings › Google › Backup: turn on Backup by Google One (or the employer's approved backup); keep work data only in company-approved apps. How to verify: Re-run the audit; Backup configured should be Compliant. Related controls: ISO 27001:2022 A.8.13 (Information backup); GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident).",
"os": "android",
"check": "gdpr.backup_configured"
},
{
"id": "fix:gdpr.backup_recent:windows",
"kind": "fix",
"title": "Recent backup on Windows",
"text": "Recent backup on Windows. Why it matters: A configured backup only helps if it has actually run recently. Risk if missing: Medium - Recent work would be lost if the device failed today. Requirement: Last backup within BACKUP_MAX_AGE_DAYS days (Pending when the date cannot be read). How to fix on Windows: (1) Check the backup tool's history and run a backup now; fix whatever stopped it (full destination, signed-out OneDrive, stopped agent). How to verify: Re-run the audit; the last backup should be within 7 days. Related controls: ISO 27001:2022 A.8.13 (Information backup); GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident).",
"os": "windows",
"check": "gdpr.backup_recent"
},
{
"id": "fix:gdpr.backup_recent:linux",
"kind": "fix",
"title": "Recent backup on Linux",
"text": "Recent backup on Linux. Why it matters: A configured backup only helps if it has actually run recently. Risk if missing: Medium - Recent work would be lost if the device failed today. Requirement: Last backup within BACKUP_MAX_AGE_DAYS days (Pending when the date cannot be read). How to fix on Linux: (1) Run the backup job now and check its timer and logs. How to verify: Re-run the audit; the last backup should be within 7 days. Related controls: ISO 27001:2022 A.8.13 (Information backup); GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident).",
"os": "linux",
"check": "gdpr.backup_recent"
},
{
"id": "fix:gdpr.backup_recent:macos",
"kind": "fix",
"title": "Recent backup on macOS",
"text": "Recent backup on macOS. Why it matters: A configured backup only helps if it has actually run recently. Risk if missing: Medium - Recent work would be lost if the device failed today. Requirement: Last backup within BACKUP_MAX_AGE_DAYS days (Pending when the date cannot be read). How to fix on macOS: (1) Run tmutil startbackup and check that the destination is reachable. How to verify: Re-run the audit; the last backup should be within 7 days. Related controls: ISO 27001:2022 A.8.13 (Information backup); GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident).",
"os": "macos",
"check": "gdpr.backup_recent"
},
{
"id": "fix:gdpr.removable_encryption:windows",
"kind": "fix",
"title": "Removable media encryption on Windows",
"text": "Removable media encryption on Windows. Why it matters: Personal data copied to removable media must be encrypted, or copying must be blocked. Risk if missing: Medium - A lost unencrypted USB drive with personal data is a reportable breach. Requirement: Data cannot be written to unencrypted removable drives. How to fix on Windows: (1) Enable 'Deny write access to removable drives not protected by BitLocker' (Group Policy: Windows Components > BitLocker Drive Encryption > Removable Data Drives), or deny USB write access. How to verify: Re-run the audit; Removable media encryption should be Compliant. Related controls: ISO 27001:2022 A.7.10 (Storage media); ISO 27001:2022 A.8.24 (Use of cryptography); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption); GDPR Art. 34 (Communication of a personal data breach to the data subject).",
"os": "windows",
"check": "gdpr.removable_encryption"
},
{
"id": "fix:gdpr.removable_encryption:linux",
"kind": "fix",
"title": "Removable media encryption on Linux",
"text": "Removable media encryption on Linux. Why it matters: Personal data copied to removable media must be encrypted, or copying must be blocked. Risk if missing: Medium - A lost unencrypted USB drive with personal data is a reportable breach. Requirement: Data cannot be written to unencrypted removable drives. How to fix on Linux: (1) Block USB storage writes (udev read-only rule or USBGuard) and provide approved encrypted drives. How to verify: Re-run the audit; Removable media encryption should be Compliant. Related controls: ISO 27001:2022 A.7.10 (Storage media); ISO 27001:2022 A.8.24 (Use of cryptography); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption); GDPR Art. 34 (Communication of a personal data breach to the data subject).",
"os": "linux",
"check": "gdpr.removable_encryption"
},
{
"id": "fix:gdpr.removable_encryption:macos",
"kind": "fix",
"title": "Removable media encryption on macOS",
"text": "Removable media encryption on macOS. Why it matters: Personal data copied to removable media must be encrypted, or copying must be blocked. Risk if missing: Medium - A lost unencrypted USB drive with personal data is a reportable breach. Requirement: Data cannot be written to unencrypted removable drives. How to fix on macOS: (1) Restrict external storage writes with your MDM or an endpoint DLP product and provide approved encrypted drives. How to verify: Re-run the audit; Removable media encryption should be Compliant. Related controls: ISO 27001:2022 A.7.10 (Storage media); ISO 27001:2022 A.8.24 (Use of cryptography); GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption); GDPR Art. 34 (Communication of a personal data breach to the data subject).",
"os": "macos",
"check": "gdpr.removable_encryption"
},
{
"id": "fix:gdpr.guest_account:windows",
"kind": "fix",
"title": "Guest account disabled on Windows",
"text": "Guest account disabled on Windows. Why it matters: Guest logins let people use the device without an identifiable account. Risk if missing: Medium - Actions by a guest cannot be traced to a person, and guests may reach shared data. Requirement: No enabled guest login. How to fix on Windows: (1) Disable the built-in Guest account: Get-LocalUser | Where-Object { $_.SID -like '*-501' } | Disable-LocalUser How to verify: Re-run the audit; Guest account disabled should be Compliant. Related controls: ISO 27001:2022 A.5.16 (Identity management); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "gdpr.guest_account"
},
{
"id": "fix:gdpr.guest_account:linux",
"kind": "fix",
"title": "Guest account disabled on Linux",
"text": "Guest account disabled on Linux. Why it matters: Guest logins let people use the device without an identifiable account. Risk if missing: Medium - Actions by a guest cannot be traced to a person, and guests may reach shared data. Requirement: No enabled guest login. How to fix on Linux: (1) Set allow-guest=false in the LightDM configuration and remove any 'guest' account with a login shell. How to verify: Re-run the audit; Guest account disabled should be Compliant. Related controls: ISO 27001:2022 A.5.16 (Identity management); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "gdpr.guest_account"
},
{
"id": "fix:gdpr.guest_account:macos",
"kind": "fix",
"title": "Guest account disabled on macOS",
"text": "Guest account disabled on macOS. Why it matters: Guest logins let people use the device without an identifiable account. Risk if missing: Medium - Actions by a guest cannot be traced to a person, and guests may reach shared data. Requirement: No enabled guest login. How to fix on macOS: (1) sudo defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool false, and turn off guest access to shared folders. How to verify: Re-run the audit; Guest account disabled should be Compliant. Related controls: ISO 27001:2022 A.5.16 (Identity management); ISO 27001:2022 A.8.5 (Secure authentication); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "gdpr.guest_account"
},
{
"id": "fix:gdpr.remote_access:windows",
"kind": "fix",
"title": "Remote access services restricted on Windows",
"text": "Remote access services restricted on Windows. Why it matters: Remote access services let others reach the device over the network; only approved ones should be on. Risk if missing: High - Unapproved remote access tools are a common entry point for attackers and support scams. Requirement: Only remote access services listed in APPROVED_REMOTE_SERVICES are enabled. How to fix on Windows: (1) Turn off the listed services if not approved: disable Remote Desktop (fDenyTSConnections = 1), stop and disable sshd/WinRM, remove unneeded shares, and uninstall unapproved tools such as TeamViewer, AnyDesk or Chrome Remote Desktop. How to verify: Re-run the audit; only approved services (none) should remain. Related controls: ISO 27001:2022 A.8.20 (Networks security); ISO 27001:2022 A.6.7 (Remote working); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "windows",
"check": "gdpr.remote_access"
},
{
"id": "fix:gdpr.remote_access:linux",
"kind": "fix",
"title": "Remote access services restricted on Linux",
"text": "Remote access services restricted on Linux. Why it matters: Remote access services let others reach the device over the network; only approved ones should be on. Risk if missing: High - Unapproved remote access tools are a common entry point for attackers and support scams. Requirement: Only remote access services listed in APPROVED_REMOTE_SERVICES are enabled. How to fix on Linux: (1) Disable unapproved services, e.g. systemctl disable --now ssh xrdp smbd, and remove unapproved remote access tools. How to verify: Re-run the audit; only approved services (none) should remain. Related controls: ISO 27001:2022 A.8.20 (Networks security); ISO 27001:2022 A.6.7 (Remote working); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "linux",
"check": "gdpr.remote_access"
},
{
"id": "fix:gdpr.remote_access:macos",
"kind": "fix",
"title": "Remote access services restricted on macOS",
"text": "Remote access services restricted on macOS. Why it matters: Remote access services let others reach the device over the network; only approved ones should be on. Risk if missing: High - Unapproved remote access tools are a common entry point for attackers and support scams. Requirement: Only remote access services listed in APPROVED_REMOTE_SERVICES are enabled. How to fix on macOS: (1) Turn off Remote Login, Screen Sharing, File Sharing and Remote Management in System Settings > General > Sharing, and uninstall unapproved tools (e.g. the Chrome Remote Desktop host). How to verify: Re-run the audit; only approved services (none) should remain. Related controls: ISO 27001:2022 A.8.20 (Networks security); ISO 27001:2022 A.6.7 (Remote working); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "macos",
"check": "gdpr.remote_access"
},
{
"id": "fix:gdpr.telemetry:windows",
"kind": "fix",
"title": "Diagnostic data minimised on Windows",
"text": "Diagnostic data minimised on Windows. Why it matters: Operating systems can send optional usage and diagnostic data, which may contain personal data, to the vendor. Risk if missing: Low - More personal data than necessary leaves the organisation. Requirement: OS diagnostic/usage data sharing is at the minimum level. How to fix on Windows: (1) Set Group Policy: Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Diagnostic Data = Send required diagnostic data (AllowTelemetry = 1; 0 on Enterprise/Education). How to verify: Re-run the audit; Diagnostic data minimised should be Compliant. Related controls: ISO 27001:2022 A.5.34 (Privacy and protection of PII); GDPR Art. 5(1)(c) (Data minimisation); GDPR Art. 25 (Data protection by design and by default).",
"os": "windows",
"check": "gdpr.telemetry"
},
{
"id": "fix:gdpr.telemetry:linux",
"kind": "fix",
"title": "Diagnostic data minimised on Linux",
"text": "Diagnostic data minimised on Linux. Why it matters: Operating systems can send optional usage and diagnostic data, which may contain personal data, to the vendor. Risk if missing: Low - More personal data than necessary leaves the organisation. Requirement: OS diagnostic/usage data sharing is at the minimum level. How to fix on Linux: (1) Opt out of popularity-contest (dpkg-reconfigure popularity-contest) and disable whoopsie if present (systemctl disable --now whoopsie). How to verify: Re-run the audit; Diagnostic data minimised should be Compliant. Related controls: ISO 27001:2022 A.5.34 (Privacy and protection of PII); GDPR Art. 5(1)(c) (Data minimisation); GDPR Art. 25 (Data protection by design and by default).",
"os": "linux",
"check": "gdpr.telemetry"
},
{
"id": "fix:gdpr.telemetry:macos",
"kind": "fix",
"title": "Diagnostic data minimised on macOS",
"text": "Diagnostic data minimised on macOS. Why it matters: Operating systems can send optional usage and diagnostic data, which may contain personal data, to the vendor. Risk if missing: Low - More personal data than necessary leaves the organisation. Requirement: OS diagnostic/usage data sharing is at the minimum level. How to fix on macOS: (1) Turn off System Settings > Privacy & Security > Analytics & Improvements > Share Mac Analytics and Share with App Developers, or enforce by profile. How to verify: Re-run the audit; Diagnostic data minimised should be Compliant. Related controls: ISO 27001:2022 A.5.34 (Privacy and protection of PII); GDPR Art. 5(1)(c) (Data minimisation); GDPR Art. 25 (Data protection by design and by default).",
"os": "macos",
"check": "gdpr.telemetry"
},
{
"id": "fix:gdpr.telemetry:ios",
"kind": "fix",
"title": "Analytics sharing minimised on iPhone",
"text": "Analytics sharing minimised on iPhone. Why it matters: Operating systems can send optional usage and diagnostic data, which may contain personal data, to the vendor. Risk if missing: Low - More personal data than necessary leaves the organisation. Requirement: OS diagnostic/usage data sharing is at the minimum level. How to fix on iPhone: (1) Settings › Privacy & Security › Analytics & Improvements: turn off Share iPhone Analytics. How to verify: Re-run the audit; Diagnostic data minimised should be Compliant. Related controls: ISO 27001:2022 A.5.34 (Privacy and protection of PII); GDPR Art. 5(1)(c) (Data minimisation); GDPR Art. 25 (Data protection by design and by default).",
"os": "ios",
"check": "gdpr.telemetry"
},
{
"id": "fix:gdpr.telemetry:android",
"kind": "fix",
"title": "Usage & diagnostics sharing minimised on Android",
"text": "Usage & diagnostics sharing minimised on Android. Why it matters: Operating systems can send optional usage and diagnostic data, which may contain personal data, to the vendor. Risk if missing: Low - More personal data than necessary leaves the organisation. Requirement: OS diagnostic/usage data sharing is at the minimum level. How to fix on Android: (1) Settings › Google › All services › Usage & diagnostics: turn off; also turn off the phone maker's diagnostics sharing. How to verify: Re-run the audit; Diagnostic data minimised should be Compliant. Related controls: ISO 27001:2022 A.5.34 (Privacy and protection of PII); GDPR Art. 5(1)(c) (Data minimisation); GDPR Art. 25 (Data protection by design and by default).",
"os": "android",
"check": "gdpr.telemetry"
},
{
"id": "fix:gdpr.lock_screen_previews:ios",
"kind": "fix",
"title": "Notification previews hidden when locked on iPhone",
"text": "Notification previews hidden when locked on iPhone. Why it matters: Previews show message and email content, often personal data, to anyone who sees the locked phone. Risk if missing: Low - Personal data in notifications can be read without unlocking the phone. Requirement: Message and email previews are not shown on the locked screen. How to fix on iPhone: (1) Settings › Notifications › Show Previews: choose When Unlocked or Never. How to verify: Re-run the phone check; previews should be hidden when the phone is locked. Related controls: ISO 27001:2022 A.7.7 (Clear desk and clear screen); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 5(1)(f) (Integrity and confidentiality); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "ios",
"check": "gdpr.lock_screen_previews"
},
{
"id": "fix:gdpr.lock_screen_previews:android",
"kind": "fix",
"title": "Sensitive notifications hidden when locked on Android",
"text": "Sensitive notifications hidden when locked on Android. Why it matters: Previews show message and email content, often personal data, to anyone who sees the locked phone. Risk if missing: Low - Personal data in notifications can be read without unlocking the phone. Requirement: Message and email previews are not shown on the locked screen. How to fix on Android: (1) Settings › Notifications › Notifications on lock screen: choose Hide sensitive content or Don't show notifications. How to verify: Re-run the phone check; previews should be hidden when the phone is locked. Related controls: ISO 27001:2022 A.7.7 (Clear desk and clear screen); ISO 27001:2022 A.8.1 (User endpoint devices); GDPR Art. 5(1)(f) (Integrity and confidentiality); GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience).",
"os": "android",
"check": "gdpr.lock_screen_previews"
},
{
"id": "fix:gdpr.personal_data_discovery:windows",
"kind": "fix",
"title": "Personal data discovery on Windows",
"text": "Personal data discovery on Windows. Why it matters: Knowing where personal data is stored on endpoints is needed for the record of processing and for storage limitation. Risk if missing: Low - Not assessed in stage 1. Requirement: Opt-in scan of user folders for personal data patterns (counts and paths only). Not implemented in stage 1: NotApplicable. How to fix on Windows: (1) No action needed now: this opt-in scan is planned for a later stage of the tool. How to verify: Not applicable in stage 1. Related controls: ISO 27001:2022 A.5.34 (Privacy and protection of PII); ISO 27001:2022 A.5.12 (Classification of information); GDPR Art. 5(1)(c) (Data minimisation); GDPR Art. 5(1)(e) (Storage limitation); GDPR Art. 30 (Records of processing activities).",
"os": "windows",
"check": "gdpr.personal_data_discovery"
},
{
"id": "fix:gdpr.personal_data_discovery:linux",
"kind": "fix",
"title": "Personal data discovery on Linux",
"text": "Personal data discovery on Linux. Why it matters: Knowing where personal data is stored on endpoints is needed for the record of processing and for storage limitation. Risk if missing: Low - Not assessed in stage 1. Requirement: Opt-in scan of user folders for personal data patterns (counts and paths only). Not implemented in stage 1: NotApplicable. How to fix on Linux: (1) No action needed now: this opt-in scan is planned for a later stage of the tool. How to verify: Not applicable in stage 1. Related controls: ISO 27001:2022 A.5.34 (Privacy and protection of PII); ISO 27001:2022 A.5.12 (Classification of information); GDPR Art. 5(1)(c) (Data minimisation); GDPR Art. 5(1)(e) (Storage limitation); GDPR Art. 30 (Records of processing activities).",
"os": "linux",
"check": "gdpr.personal_data_discovery"
},
{
"id": "fix:gdpr.personal_data_discovery:macos",
"kind": "fix",
"title": "Personal data discovery on macOS",
"text": "Personal data discovery on macOS. Why it matters: Knowing where personal data is stored on endpoints is needed for the record of processing and for storage limitation. Risk if missing: Low - Not assessed in stage 1. Requirement: Opt-in scan of user folders for personal data patterns (counts and paths only). Not implemented in stage 1: NotApplicable. How to fix on macOS: (1) No action needed now: this opt-in scan is planned for a later stage of the tool. How to verify: Not applicable in stage 1. Related controls: ISO 27001:2022 A.5.34 (Privacy and protection of PII); ISO 27001:2022 A.5.12 (Classification of information); GDPR Art. 5(1)(c) (Data minimisation); GDPR Art. 5(1)(e) (Storage limitation); GDPR Art. 30 (Records of processing activities).",
"os": "macos",
"check": "gdpr.personal_data_discovery"
},
{
"id": "fix:aiact.inventory:windows",
"kind": "fix",
"title": "AI software inventory on Windows",
"text": "AI software inventory on Windows. Why it matters: Deployers must know which AI systems they use before they can classify and govern them. Risk if missing: Low - The inventory itself is information; the risk lies in unapproved or unclassified tools. Requirement: AI apps, local AI services and local model folders are listed (Compliant = inventory taken). How to fix on Windows: (1) Add the AI tools found on this device to the organisation's AI register, with owner and purpose. How to verify: The AI register lists every tool in the inventory. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); GDPR Art. 30 (Records of processing activities); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "windows",
"check": "aiact.inventory"
},
{
"id": "fix:aiact.inventory:linux",
"kind": "fix",
"title": "AI software inventory on Linux",
"text": "AI software inventory on Linux. Why it matters: Deployers must know which AI systems they use before they can classify and govern them. Risk if missing: Low - The inventory itself is information; the risk lies in unapproved or unclassified tools. Requirement: AI apps, local AI services and local model folders are listed (Compliant = inventory taken). How to fix on Linux: (1) Add the AI tools found on this device to the organisation's AI register, with owner and purpose. How to verify: The AI register lists every tool in the inventory. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); GDPR Art. 30 (Records of processing activities); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "linux",
"check": "aiact.inventory"
},
{
"id": "fix:aiact.inventory:macos",
"kind": "fix",
"title": "AI software inventory on macOS",
"text": "AI software inventory on macOS. Why it matters: Deployers must know which AI systems they use before they can classify and govern them. Risk if missing: Low - The inventory itself is information; the risk lies in unapproved or unclassified tools. Requirement: AI apps, local AI services and local model folders are listed (Compliant = inventory taken). How to fix on macOS: (1) Add the AI tools found on this device to the organisation's AI register, with owner and purpose. How to verify: The AI register lists every tool in the inventory. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); GDPR Art. 30 (Records of processing activities); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "macos",
"check": "aiact.inventory"
},
{
"id": "fix:aiact.inventory:ios",
"kind": "fix",
"title": "AI software inventory on iPhone",
"text": "AI software inventory on iPhone. Why it matters: Deployers must know which AI systems they use before they can classify and govern them. Risk if missing: Low - The inventory itself is information; the risk lies in unapproved or unclassified tools. Requirement: AI apps, local AI services and local model folders are listed (Compliant = inventory taken). How to fix on iPhone: (1) Add the AI tools found on this device to the organisation's AI register, with owner and purpose. How to verify: The AI register lists every tool in the inventory. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); GDPR Art. 30 (Records of processing activities); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "ios",
"check": "aiact.inventory"
},
{
"id": "fix:aiact.inventory:android",
"kind": "fix",
"title": "AI software inventory on Android",
"text": "AI software inventory on Android. Why it matters: Deployers must know which AI systems they use before they can classify and govern them. Risk if missing: Low - The inventory itself is information; the risk lies in unapproved or unclassified tools. Requirement: AI apps, local AI services and local model folders are listed (Compliant = inventory taken). How to fix on Android: (1) Add the AI tools found on this device to the organisation's AI register, with owner and purpose. How to verify: The AI register lists every tool in the inventory. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); GDPR Art. 30 (Records of processing activities); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "android",
"check": "aiact.inventory"
},
{
"id": "fix:aiact.unapproved:windows",
"kind": "fix",
"title": "Unapproved AI tools (shadow AI) on Windows",
"text": "Unapproved AI tools (shadow AI) on Windows. Why it matters: AI tools used without approval may send work and personal data to providers without contracts or a transfer basis. Risk if missing: Medium - Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations. Requirement: Every AI tool found is listed in APPROVED_AI_TOOLS. How to fix on Windows: (1) Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it. (2) Publish an AI acceptable-use policy so staff know which tools are allowed. (3) Remove unapproved apps (Settings > Apps) or block them with AppLocker / Intune app control. How to verify: Re-run the audit; Unapproved AI tools should read none. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 28 (Processor); GDPR Art. 44 (General principle for transfers); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "windows",
"check": "aiact.unapproved"
},
{
"id": "fix:aiact.unapproved:linux",
"kind": "fix",
"title": "Unapproved AI tools (shadow AI) on Linux",
"text": "Unapproved AI tools (shadow AI) on Linux. Why it matters: AI tools used without approval may send work and personal data to providers without contracts or a transfer basis. Risk if missing: Medium - Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations. Requirement: Every AI tool found is listed in APPROVED_AI_TOOLS. How to fix on Linux: (1) Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it. (2) Publish an AI acceptable-use policy so staff know which tools are allowed. (3) Remove unapproved tools with the package manager and restrict installation rights. How to verify: Re-run the audit; Unapproved AI tools should read none. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 28 (Processor); GDPR Art. 44 (General principle for transfers); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "linux",
"check": "aiact.unapproved"
},
{
"id": "fix:aiact.unapproved:macos",
"kind": "fix",
"title": "Unapproved AI tools (shadow AI) on macOS",
"text": "Unapproved AI tools (shadow AI) on macOS. Why it matters: AI tools used without approval may send work and personal data to providers without contracts or a transfer basis. Risk if missing: Medium - Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations. Requirement: Every AI tool found is listed in APPROVED_AI_TOOLS. How to fix on macOS: (1) Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it. (2) Publish an AI acceptable-use policy so staff know which tools are allowed. (3) Remove unapproved apps and restrict installations through your MDM. How to verify: Re-run the audit; Unapproved AI tools should read none. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 28 (Processor); GDPR Art. 44 (General principle for transfers); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "macos",
"check": "aiact.unapproved"
},
{
"id": "fix:aiact.unapproved:ios",
"kind": "fix",
"title": "Unapproved AI tools (shadow AI) on iPhone",
"text": "Unapproved AI tools (shadow AI) on iPhone. Why it matters: AI tools used without approval may send work and personal data to providers without contracts or a transfer basis. Risk if missing: Medium - Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations. Requirement: Every AI tool found is listed in APPROVED_AI_TOOLS. How to fix on iPhone: (1) Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it. (2) Publish an AI acceptable-use policy so staff know which tools are allowed. How to verify: Re-run the audit; Unapproved AI tools should read none. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 28 (Processor); GDPR Art. 44 (General principle for transfers); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "ios",
"check": "aiact.unapproved"
},
{
"id": "fix:aiact.unapproved:android",
"kind": "fix",
"title": "Unapproved AI tools (shadow AI) on Android",
"text": "Unapproved AI tools (shadow AI) on Android. Why it matters: AI tools used without approval may send work and personal data to providers without contracts or a transfer basis. Risk if missing: Medium - Shadow AI can leak confidential or personal data and creates unassessed AI Act and GDPR obligations. Requirement: Every AI tool found is listed in APPROVED_AI_TOOLS. How to fix on Android: (1) Decide for each listed tool: approve it (add to APPROVED_AI_TOOLS after a data protection and AI Act review, with a data processing agreement where needed) or remove it. (2) Publish an AI acceptable-use policy so staff know which tools are allowed. How to verify: Re-run the audit; Unapproved AI tools should read none. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); ISO 27001:2022 A.8.19 (Installation of software on operational systems); GDPR Art. 28 (Processor); GDPR Art. 44 (General principle for transfers); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "android",
"check": "aiact.unapproved"
},
{
"id": "fix:aiact.risk_classification:windows",
"kind": "fix",
"title": "AI system risk classification on Windows",
"text": "AI system risk classification on Windows. Why it matters: Each AI system must be checked against the banned practices and the high-risk uses in Annex III. Risk if missing: Medium - An unclassified tool could be used for a high-risk or prohibited purpose without the required safeguards. Requirement: Each AI tool found is classified (prohibited / high-risk / limited / minimal). Done by the auditor model: Pending in the collector output, NotApplicable when no AI tool is found. How to fix on Windows: (1) Record the purpose for which each listed tool is used and classify it (prohibited, high-risk, limited-risk transparency, minimal). The auditor model does this from the inventory and the stated purpose. How to verify: Every AI tool in the inventory has a classification in the AI register. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); EU AI Act Art. 5 (Prohibited AI practices); EU AI Act Art. 6 (Classification rules for high-risk AI systems); EU AI Act Annex III (High-risk AI systems referred to in Article 6(2)).",
"os": "windows",
"check": "aiact.risk_classification"
},
{
"id": "fix:aiact.risk_classification:linux",
"kind": "fix",
"title": "AI system risk classification on Linux",
"text": "AI system risk classification on Linux. Why it matters: Each AI system must be checked against the banned practices and the high-risk uses in Annex III. Risk if missing: Medium - An unclassified tool could be used for a high-risk or prohibited purpose without the required safeguards. Requirement: Each AI tool found is classified (prohibited / high-risk / limited / minimal). Done by the auditor model: Pending in the collector output, NotApplicable when no AI tool is found. How to fix on Linux: (1) Record the purpose for which each listed tool is used and classify it (prohibited, high-risk, limited-risk transparency, minimal). The auditor model does this from the inventory and the stated purpose. How to verify: Every AI tool in the inventory has a classification in the AI register. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); EU AI Act Art. 5 (Prohibited AI practices); EU AI Act Art. 6 (Classification rules for high-risk AI systems); EU AI Act Annex III (High-risk AI systems referred to in Article 6(2)).",
"os": "linux",
"check": "aiact.risk_classification"
},
{
"id": "fix:aiact.risk_classification:macos",
"kind": "fix",
"title": "AI system risk classification on macOS",
"text": "AI system risk classification on macOS. Why it matters: Each AI system must be checked against the banned practices and the high-risk uses in Annex III. Risk if missing: Medium - An unclassified tool could be used for a high-risk or prohibited purpose without the required safeguards. Requirement: Each AI tool found is classified (prohibited / high-risk / limited / minimal). Done by the auditor model: Pending in the collector output, NotApplicable when no AI tool is found. How to fix on macOS: (1) Record the purpose for which each listed tool is used and classify it (prohibited, high-risk, limited-risk transparency, minimal). The auditor model does this from the inventory and the stated purpose. How to verify: Every AI tool in the inventory has a classification in the AI register. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); EU AI Act Art. 5 (Prohibited AI practices); EU AI Act Art. 6 (Classification rules for high-risk AI systems); EU AI Act Annex III (High-risk AI systems referred to in Article 6(2)).",
"os": "macos",
"check": "aiact.risk_classification"
},
{
"id": "fix:aiact.risk_classification:ios",
"kind": "fix",
"title": "AI system risk classification on iPhone",
"text": "AI system risk classification on iPhone. Why it matters: Each AI system must be checked against the banned practices and the high-risk uses in Annex III. Risk if missing: Medium - An unclassified tool could be used for a high-risk or prohibited purpose without the required safeguards. Requirement: Each AI tool found is classified (prohibited / high-risk / limited / minimal). Done by the auditor model: Pending in the collector output, NotApplicable when no AI tool is found. How to fix on iPhone: (1) Record the purpose for which each listed tool is used and classify it (prohibited, high-risk, limited-risk transparency, minimal). The auditor model does this from the inventory and the stated purpose. How to verify: Every AI tool in the inventory has a classification in the AI register. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); EU AI Act Art. 5 (Prohibited AI practices); EU AI Act Art. 6 (Classification rules for high-risk AI systems); EU AI Act Annex III (High-risk AI systems referred to in Article 6(2)).",
"os": "ios",
"check": "aiact.risk_classification"
},
{
"id": "fix:aiact.risk_classification:android",
"kind": "fix",
"title": "AI system risk classification on Android",
"text": "AI system risk classification on Android. Why it matters: Each AI system must be checked against the banned practices and the high-risk uses in Annex III. Risk if missing: Medium - An unclassified tool could be used for a high-risk or prohibited purpose without the required safeguards. Requirement: Each AI tool found is classified (prohibited / high-risk / limited / minimal). Done by the auditor model: Pending in the collector output, NotApplicable when no AI tool is found. How to fix on Android: (1) Record the purpose for which each listed tool is used and classify it (prohibited, high-risk, limited-risk transparency, minimal). The auditor model does this from the inventory and the stated purpose. How to verify: Every AI tool in the inventory has a classification in the AI register. Related controls: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); EU AI Act Art. 5 (Prohibited AI practices); EU AI Act Art. 6 (Classification rules for high-risk AI systems); EU AI Act Annex III (High-risk AI systems referred to in Article 6(2)).",
"os": "android",
"check": "aiact.risk_classification"
},
{
"id": "fix:aiact.os_ai_features:windows",
"kind": "fix",
"title": "Windows Recall / Copilot data analysis disabled on Windows",
"text": "Windows Recall / Copilot data analysis disabled on Windows. Why it matters: Built-in OS AI features can capture screen content or send text to external AI services. Risk if missing: Medium - Screen snapshots or prompts can contain personal and confidential data processed without a defined purpose. Requirement: OS-level AI features that capture or send user data are disabled by policy. NotApplicable where the OS has none. Phones: external AI integrations (ChatGPT in Apple Intelligence, assistant access to screen content) are off unless approved. How to fix on Windows: (1) Set Group Policy: Administrative Templates > Windows Components > Windows AI > Turn off saving snapshots for use with Recall = Enabled (DisableAIDataAnalysis = 1), unless Recall has been assessed and approved. How to verify: Re-run the audit; the OS AI features check should be Compliant or NotApplicable. Related controls: ISO 27001:2022 A.5.34 (Privacy and protection of PII); GDPR Art. 5(1)(c) (Data minimisation); GDPR Art. 25 (Data protection by design and by default); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "windows",
"check": "aiact.os_ai_features"
},
{
"id": "fix:aiact.os_ai_features:linux",
"kind": "fix",
"title": "Operating system AI features restricted on Linux",
"text": "Operating system AI features restricted on Linux. Why it matters: Built-in OS AI features can capture screen content or send text to external AI services. Risk if missing: Medium - Screen snapshots or prompts can contain personal and confidential data processed without a defined purpose. Requirement: OS-level AI features that capture or send user data are disabled by policy. NotApplicable where the OS has none. Phones: external AI integrations (ChatGPT in Apple Intelligence, assistant access to screen content) are off unless approved. How to fix on Linux: (1) No action needed: Linux distributions have no built-in AI assistant. How to verify: Re-run the audit; the OS AI features check should be Compliant or NotApplicable. Related controls: ISO 27001:2022 A.5.34 (Privacy and protection of PII); GDPR Art. 5(1)(c) (Data minimisation); GDPR Art. 25 (Data protection by design and by default); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "linux",
"check": "aiact.os_ai_features"
},
{
"id": "fix:aiact.os_ai_features:macos",
"kind": "fix",
"title": "Apple Intelligence external integrations restricted on macOS",
"text": "Apple Intelligence external integrations restricted on macOS. Why it matters: Built-in OS AI features can capture screen content or send text to external AI services. Risk if missing: Medium - Screen snapshots or prompts can contain personal and confidential data processed without a defined purpose. Requirement: OS-level AI features that capture or send user data are disabled by policy. NotApplicable where the OS has none. Phones: external AI integrations (ChatGPT in Apple Intelligence, assistant access to screen content) are off unless approved. How to fix on macOS: (1) Deploy a Restrictions profile with allowExternalIntelligenceIntegrations = false (and restrict other Apple Intelligence features your policy does not allow). How to verify: Re-run the audit; the OS AI features check should be Compliant or NotApplicable. Related controls: ISO 27001:2022 A.5.34 (Privacy and protection of PII); GDPR Art. 5(1)(c) (Data minimisation); GDPR Art. 25 (Data protection by design and by default); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "macos",
"check": "aiact.os_ai_features"
},
{
"id": "fix:aiact.os_ai_features:ios",
"kind": "fix",
"title": "Apple Intelligence external integrations restricted on iPhone",
"text": "Apple Intelligence external integrations restricted on iPhone. Why it matters: Built-in OS AI features can capture screen content or send text to external AI services. Risk if missing: Medium - Screen snapshots or prompts can contain personal and confidential data processed without a defined purpose. Requirement: OS-level AI features that capture or send user data are disabled by policy. NotApplicable where the OS has none. Phones: external AI integrations (ChatGPT in Apple Intelligence, assistant access to screen content) are off unless approved. How to fix on iPhone: (1) Settings › Apple Intelligence & Siri › ChatGPT: turn off unless the organisation has approved it; the employer can restrict it with a configuration profile. How to verify: Re-run the audit; the OS AI features check should be Compliant or NotApplicable. Related controls: ISO 27001:2022 A.5.34 (Privacy and protection of PII); GDPR Art. 5(1)(c) (Data minimisation); GDPR Art. 25 (Data protection by design and by default); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "ios",
"check": "aiact.os_ai_features"
},
{
"id": "fix:aiact.os_ai_features:android",
"kind": "fix",
"title": "AI assistant access restricted on Android",
"text": "AI assistant access restricted on Android. Why it matters: Built-in OS AI features can capture screen content or send text to external AI services. Risk if missing: Medium - Screen snapshots or prompts can contain personal and confidential data processed without a defined purpose. Requirement: OS-level AI features that capture or send user data are disabled by policy. NotApplicable where the OS has none. Phones: external AI integrations (ChatGPT in Apple Intelligence, assistant access to screen content) are off unless approved. How to fix on Android: (1) In the Gemini app (or other assistant) settings, turn off screen context / access to app content unless the organisation has approved it. How to verify: Re-run the audit; the OS AI features check should be Compliant or NotApplicable. Related controls: ISO 27001:2022 A.5.34 (Privacy and protection of PII); GDPR Art. 5(1)(c) (Data minimisation); GDPR Art. 25 (Data protection by design and by default); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"os": "android",
"check": "aiact.os_ai_features"
},
{
"id": "fix:aiact.log_retention:windows",
"kind": "fix",
"title": "AI usage log retention on Windows",
"text": "AI usage log retention on Windows. Why it matters: Deployers of high-risk AI systems must keep the system's logs for at least six months. Risk if missing: Medium - Missing logs prevent monitoring and investigation of high-risk AI use. Requirement: Logs kept >= 6 months if a high-risk AI system is used. Pending until classification; NotApplicable when no AI tool is found. How to fix on Windows: (1) If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months. How to verify: Log retention is documented for each high-risk AI system. Related controls: ISO 27001:2022 A.8.15 (Logging); EU AI Act Art. 26(6) (Deployers: keep automatically generated logs for at least six months).",
"os": "windows",
"check": "aiact.log_retention"
},
{
"id": "fix:aiact.log_retention:linux",
"kind": "fix",
"title": "AI usage log retention on Linux",
"text": "AI usage log retention on Linux. Why it matters: Deployers of high-risk AI systems must keep the system's logs for at least six months. Risk if missing: Medium - Missing logs prevent monitoring and investigation of high-risk AI use. Requirement: Logs kept >= 6 months if a high-risk AI system is used. Pending until classification; NotApplicable when no AI tool is found. How to fix on Linux: (1) If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months. How to verify: Log retention is documented for each high-risk AI system. Related controls: ISO 27001:2022 A.8.15 (Logging); EU AI Act Art. 26(6) (Deployers: keep automatically generated logs for at least six months).",
"os": "linux",
"check": "aiact.log_retention"
},
{
"id": "fix:aiact.log_retention:macos",
"kind": "fix",
"title": "AI usage log retention on macOS",
"text": "AI usage log retention on macOS. Why it matters: Deployers of high-risk AI systems must keep the system's logs for at least six months. Risk if missing: Medium - Missing logs prevent monitoring and investigation of high-risk AI use. Requirement: Logs kept >= 6 months if a high-risk AI system is used. Pending until classification; NotApplicable when no AI tool is found. How to fix on macOS: (1) If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months. How to verify: Log retention is documented for each high-risk AI system. Related controls: ISO 27001:2022 A.8.15 (Logging); EU AI Act Art. 26(6) (Deployers: keep automatically generated logs for at least six months).",
"os": "macos",
"check": "aiact.log_retention"
},
{
"id": "fix:aiact.log_retention:ios",
"kind": "fix",
"title": "AI usage log retention on iPhone",
"text": "AI usage log retention on iPhone. Why it matters: Deployers of high-risk AI systems must keep the system's logs for at least six months. Risk if missing: Medium - Missing logs prevent monitoring and investigation of high-risk AI use. Requirement: Logs kept >= 6 months if a high-risk AI system is used. Pending until classification; NotApplicable when no AI tool is found. How to fix on iPhone: (1) If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months. How to verify: Log retention is documented for each high-risk AI system. Related controls: ISO 27001:2022 A.8.15 (Logging); EU AI Act Art. 26(6) (Deployers: keep automatically generated logs for at least six months).",
"os": "ios",
"check": "aiact.log_retention"
},
{
"id": "fix:aiact.log_retention:android",
"kind": "fix",
"title": "AI usage log retention on Android",
"text": "AI usage log retention on Android. Why it matters: Deployers of high-risk AI systems must keep the system's logs for at least six months. Risk if missing: Medium - Missing logs prevent monitoring and investigation of high-risk AI use. Requirement: Logs kept >= 6 months if a high-risk AI system is used. Pending until classification; NotApplicable when no AI tool is found. How to fix on Android: (1) If any listed tool is classified high-risk, keep its automatically generated logs under your control for at least six months. How to verify: Log retention is documented for each high-risk AI system. Related controls: ISO 27001:2022 A.8.15 (Logging); EU AI Act Art. 26(6) (Deployers: keep automatically generated logs for at least six months).",
"os": "android",
"check": "aiact.log_retention"
},
{
"id": "fix:org.ropa",
"kind": "fix",
"title": "Record of processing activities",
"text": "Record of processing activities is an organisational control, answered once by the organisation, not read from a device. The record of processing activities is the core GDPR accountability document. Rule: Answer yes = Compliant, no/partial = Non-Compliant, n/a = NotApplicable, unanswered = Pending. Related: ISO 27001:2022 A.5.34 (Privacy and protection of PII); GDPR Art. 30 (Records of processing activities).",
"check": "org.ropa"
},
{
"id": "fix:org.dpia",
"kind": "fix",
"title": "Data protection impact assessment",
"text": "Data protection impact assessment is an organisational control, answered once by the organisation, not read from a device. High-risk processing needs a data protection impact assessment before it starts. Rule: As above. Related: ISO 27001:2022 A.5.34 (Privacy and protection of PII); GDPR Art. 35 (Data protection impact assessment).",
"check": "org.dpia"
},
{
"id": "fix:org.breach_procedure",
"kind": "fix",
"title": "Breach response procedure",
"text": "Breach response procedure is an organisational control, answered once by the organisation, not read from a device. Breaches must be reported to the supervisory authority within 72 hours where required. Rule: As above. Related: ISO 27001:2022 A.5.24 (Information security incident management planning and preparation); ISO 27001:2022 A.5.26 (Response to information security incidents); GDPR Art. 33 (Notification of a personal data breach to the supervisory authority); GDPR Art. 34 (Communication of a personal data breach to the data subject).",
"check": "org.breach_procedure"
},
{
"id": "fix:org.processor_agreements",
"kind": "fix",
"title": "Data processing agreements",
"text": "Data processing agreements is an organisational control, answered once by the organisation, not read from a device. Every processor, including cloud and AI providers, needs a contract with the GDPR Article 28 terms. Rule: As above. Related: ISO 27001:2022 A.5.20 (Addressing information security within supplier agreements); GDPR Art. 28 (Processor).",
"check": "org.processor_agreements"
},
{
"id": "fix:org.ai_register",
"kind": "fix",
"title": "AI register",
"text": "AI register is an organisational control, answered once by the organisation, not read from a device. A register of AI systems is the basis for AI Act classification and deployer duties. Rule: As above. Related: ISO 27001:2022 A.5.9 (Inventory of information and other associated assets); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"check": "org.ai_register"
},
{
"id": "fix:org.ai_literacy",
"kind": "fix",
"title": "AI literacy training",
"text": "AI literacy training is an organisational control, answered once by the organisation, not read from a device. Since 2 February 2025, organisations must ensure staff using AI have sufficient AI literacy. Rule: As above. Related: ISO 27001:2022 A.6.3 (Information security awareness, education and training); EU AI Act Art. 4 (AI literacy).",
"check": "org.ai_literacy"
},
{
"id": "fix:org.human_oversight",
"kind": "fix",
"title": "Human oversight for high-risk AI",
"text": "Human oversight for high-risk AI is an organisational control, answered once by the organisation, not read from a device. High-risk AI systems need trained people who can understand, monitor and override them. Rule: As above. Related: EU AI Act Art. 14 (Human oversight); EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems).",
"check": "org.human_oversight"
},
{
"id": "fix:org.ai_transparency",
"kind": "fix",
"title": "AI transparency to users",
"text": "AI transparency to users is an organisational control, answered once by the organisation, not read from a device. People must know when they deal with AI or AI-generated content. Rule: As above. Related: EU AI Act Art. 50 (Transparency obligations for providers and deployers of certain AI systems).",
"check": "org.ai_transparency"
},
{
"id": "control:ISO 27001:2022:A.5.9",
"kind": "control",
"title": "ISO 27001:2022 A.5.9 Inventory of information and other associated assets",
"text": "ISO 27001:2022 A.5.9 (Inventory of information and other associated assets): Know which information assets, devices and software exist and who owns them, and keep that list current. An auditor looks for: An up-to-date asset list that includes endpoints and installed software; An owner for each asset. On endpoints: Each endpoint and the software on it (including AI tools) should appear in the inventory."
},
{
"id": "control:ISO 27001:2022:A.5.12",
"kind": "control",
"title": "ISO 27001:2022 A.5.12 Classification of information",
"text": "ISO 27001:2022 A.5.12 (Classification of information): Label information by how sensitive it is so that the right protection can be applied. An auditor looks for: A classification scheme; Evidence that sensitive data is identified, e.g. personal data. On endpoints: Personal or confidential files stored on laptops need to be found and protected accordingly."
},
{
"id": "control:ISO 27001:2022:A.5.15",
"kind": "control",
"title": "ISO 27001:2022 A.5.15 Access control",
"text": "ISO 27001:2022 A.5.15 (Access control): Grant access to information and systems based on business need, and document the rules. An auditor looks for: An access control policy; Administrative access limited to named, approved people. On endpoints: Only approved IT staff should hold administrator rights on endpoints."
},
{
"id": "control:ISO 27001:2022:A.5.16",
"kind": "control",
"title": "ISO 27001:2022 A.5.16 Identity management",
"text": "ISO 27001:2022 A.5.16 (Identity management): Every account belongs to an identifiable person or a documented service, through its whole life cycle. An auditor looks for: No shared or anonymous accounts; Disabled guest and default accounts. On endpoints: Guest accounts and anonymous logins break the link between actions and people."
},
{
"id": "control:ISO 27001:2022:A.5.17",
"kind": "control",
"title": "ISO 27001:2022 A.5.17 Authentication information",
"text": "ISO 27001:2022 A.5.17 (Authentication information): Passwords and other secrets are allocated, managed and protected under clear rules. An auditor looks for: A password rule set (length, reuse, change) enforced by the system; Users told how to protect their passwords. On endpoints: The device's password policy is the technical enforcement of these rules."
},
{
"id": "control:ISO 27001:2022:A.5.18",
"kind": "control",
"title": "ISO 27001:2022 A.5.18 Access rights",
"text": "ISO 27001:2022 A.5.18 (Access rights): Access rights are granted, reviewed regularly and removed when no longer needed. An auditor looks for: Periodic review of who has administrator rights; Removal of rights that are not justified. On endpoints: Employee accounts that are local administrators without approval are a finding."
},
{
"id": "control:ISO 27001:2022:A.5.20",
"kind": "control",
"title": "ISO 27001:2022 A.5.20 Addressing information security within supplier agreements",
"text": "ISO 27001:2022 A.5.20 (Addressing information security within supplier agreements): Agreements with suppliers set out the security requirements they must meet. An auditor looks for: Signed agreements with security and data protection clauses. On endpoints: Cloud and AI services used from endpoints are suppliers that need agreements."
},
{
"id": "control:ISO 27001:2022:A.5.24",
"kind": "control",
"title": "ISO 27001:2022 A.5.24 Information security incident management planning and preparation",
"text": "ISO 27001:2022 A.5.24 (Information security incident management planning and preparation): Plan in advance how security incidents are reported, handled and communicated. An auditor looks for: A documented incident procedure with roles; Contact points and escalation paths. On endpoints: Endpoint logs and alerts feed the incident process."
},
{
"id": "control:ISO 27001:2022:A.5.26",
"kind": "control",
"title": "ISO 27001:2022 A.5.26 Response to information security incidents",
"text": "ISO 27001:2022 A.5.26 (Response to information security incidents): Respond to incidents according to the documented procedure. An auditor looks for: Records of past incidents and how they were handled. On endpoints: Investigations depend on endpoint evidence being available and trustworthy."
},
{
"id": "control:ISO 27001:2022:A.5.34",
"kind": "control",
"title": "ISO 27001:2022 A.5.34 Privacy and protection of PII",
"text": "ISO 27001:2022 A.5.34 (Privacy and protection of PII): Meet the legal and contractual requirements for protecting personal data. An auditor looks for: Links between the ISMS and GDPR compliance; Minimised collection and sharing of personal data. On endpoints: Diagnostic data sharing and OS AI features can send personal data off the device."
},
{
"id": "control:ISO 27001:2022:A.6.3",
"kind": "control",
"title": "ISO 27001:2022 A.6.3 Information security awareness, education and training",
"text": "ISO 27001:2022 A.6.3 (Information security awareness, education and training): People receive awareness and training suited to their role, and it is kept current. An auditor looks for: Training records; Topics that match the risks people face (including AI use). On endpoints: Users decide what they install and share; training reduces shadow IT and shadow AI."
},
{
"id": "control:ISO 27001:2022:A.6.7",
"kind": "control",
"title": "ISO 27001:2022 A.6.7 Remote working",
"text": "ISO 27001:2022 A.6.7 (Remote working): Protect information accessed, processed or stored outside the organisation's premises. An auditor looks for: Rules for remote access tools; Only approved remote access services enabled. On endpoints: Remote desktop and screen sharing services open the device to outside access."
},
{
"id": "control:ISO 27001:2022:A.7.7",
"kind": "control",
"title": "ISO 27001:2022 A.7.7 Clear desk and clear screen",
"text": "ISO 27001:2022 A.7.7 (Clear desk and clear screen): Unattended screens and papers must not expose information. An auditor looks for: Automatic screen lock after a short idle time; A password needed to unlock. On endpoints: The screen lock settings are the technical control for clear screen."
},
{
"id": "control:ISO 27001:2022:A.7.10",
"kind": "control",
"title": "ISO 27001:2022 A.7.10 Storage media",
"text": "ISO 27001:2022 A.7.10 (Storage media): Manage removable media through its life cycle according to the classification of the data on it. An auditor looks for: Rules for USB and external drives; Encryption or blocking of removable media. On endpoints: Unrestricted USB writing lets data leave the device unencrypted."
},
{
"id": "control:ISO 27001:2022:A.8.1",
"kind": "control",
"title": "ISO 27001:2022 A.8.1 User endpoint devices",
"text": "ISO 27001:2022 A.8.1 (User endpoint devices): Protect information stored on, processed by or reachable from user devices. An auditor looks for: A baseline configuration for laptops and desktops; Encryption, firewall, screen lock and malware protection enforced. On endpoints: This is the main control the whole endpoint baseline supports."
},
{
"id": "control:ISO 27001:2022:A.8.2",
"kind": "control",
"title": "ISO 27001:2022 A.8.2 Privileged access rights",
"text": "ISO 27001:2022 A.8.2 (Privileged access rights): Restrict and manage the allocation and use of administrator rights. An auditor looks for: Named, approved administrators; No everyday user accounts with administrator rights. On endpoints: Local administrator membership on each device shows whether this control works."
},
{
"id": "control:ISO 27001:2022:A.8.5",
"kind": "control",
"title": "ISO 27001:2022 A.8.5 Secure authentication",
"text": "ISO 27001:2022 A.8.5 (Secure authentication): Authentication methods and procedures resist guessing, brute force and misuse. An auditor looks for: Account lockout after repeated failures; Strong password or multi-factor requirements. On endpoints: Lockout, complexity and screen-unlock settings implement this on the device."
},
{
"id": "control:ISO 27001:2022:A.8.7",
"kind": "control",
"title": "ISO 27001:2022 A.8.7 Protection against malware",
"text": "ISO 27001:2022 A.8.7 (Protection against malware): Protect against malware with technical controls supported by user awareness. An auditor looks for: Anti-malware running with current signatures; Protection that cannot easily be switched off. On endpoints: Antivirus status, real-time scanning, tamper protection and signature age are checked on each device."
},
{
"id": "control:ISO 27001:2022:A.8.8",
"kind": "control",
"title": "ISO 27001:2022 A.8.8 Management of technical vulnerabilities",
"text": "ISO 27001:2022 A.8.8 (Management of technical vulnerabilities): Find technical weaknesses in time, judge the exposure and fix them. An auditor looks for: Timely patching; Supported operating system versions. On endpoints: Automatic updates, recent patch dates and a supported OS show vulnerabilities are being managed."
},
{
"id": "control:ISO 27001:2022:A.8.12",
"kind": "control",
"title": "ISO 27001:2022 A.8.12 Data leakage prevention",
"text": "ISO 27001:2022 A.8.12 (Data leakage prevention): Apply measures that stop sensitive information leaving through unauthorised channels. An auditor looks for: Controls on removable media and uploads; Monitoring of data leaving the organisation. On endpoints: USB storage write access is a common leakage channel."
},
{
"id": "control:ISO 27001:2022:A.8.13",
"kind": "control",
"title": "ISO 27001:2022 A.8.13 Information backup",
"text": "ISO 27001:2022 A.8.13 (Information backup): Keep backup copies of information and software and test that they can be restored. An auditor looks for: Backups configured and recent; Recovery keys and restore procedures available. On endpoints: Work stored only on a laptop is lost if the device fails, is stolen or is encrypted by ransomware."
},
{
"id": "control:ISO 27001:2022:A.8.15",
"kind": "control",
"title": "ISO 27001:2022 A.8.15 Logging",
"text": "ISO 27001:2022 A.8.15 (Logging): Produce, protect and review logs of activities, exceptions and security events. An auditor looks for: Logon and account changes recorded; Logs kept long enough for investigation. On endpoints: Without security event logs, a breach on the device cannot be reconstructed."
},
{
"id": "control:ISO 27001:2022:A.8.17",
"kind": "control",
"title": "ISO 27001:2022 A.8.17 Clock synchronization",
"text": "ISO 27001:2022 A.8.17 (Clock synchronization): Synchronise system clocks to an approved time source. An auditor looks for: All devices using network time. On endpoints: Correct timestamps are needed to correlate events across devices during an incident."
},
{
"id": "control:ISO 27001:2022:A.8.19",
"kind": "control",
"title": "ISO 27001:2022 A.8.19 Installation of software on operational systems",
"text": "ISO 27001:2022 A.8.19 (Installation of software on operational systems): Control which software users may install. An auditor looks for: An approved software list; Restrictions on self-installed software. On endpoints: Unapproved AI tools and remote access tools are signs this control is missing."
},
{
"id": "control:ISO 27001:2022:A.8.20",
"kind": "control",
"title": "ISO 27001:2022 A.8.20 Networks security",
"text": "ISO 27001:2022 A.8.20 (Networks security): Secure, manage and control networks and network devices to protect information. An auditor looks for: Host firewalls enabled; Unsolicited inbound connections blocked. On endpoints: The host firewall protects the laptop on untrusted networks such as hotels and cafés."
},
{
"id": "control:ISO 27001:2022:A.8.24",
"kind": "control",
"title": "ISO 27001:2022 A.8.24 Use of cryptography",
"text": "ISO 27001:2022 A.8.24 (Use of cryptography): Define and apply rules for using cryptography, including key management. An auditor looks for: Full-disk encryption with strong algorithms; Recovery keys stored safely. On endpoints: Disk encryption protects data on lost or stolen devices."
},
{
"id": "control:GDPR:Art. 5(1)(c)",
"kind": "control",
"title": "GDPR Art. 5(1)(c) Data minimisation",
"text": "GDPR Art. 5(1)(c) (Data minimisation): Personal data must be adequate, relevant and limited to what is necessary for the purpose. An auditor looks for: Only necessary data collected or shared; OS and app data sharing reduced to the minimum. On endpoints: Optional diagnostic data and AI features that capture screen content collect more than needed."
},
{
"id": "control:GDPR:Art. 5(1)(e)",
"kind": "control",
"title": "GDPR Art. 5(1)(e) Storage limitation",
"text": "GDPR Art. 5(1)(e) (Storage limitation): Personal data must not be kept in identifiable form longer than necessary. An auditor looks for: Retention rules; Old personal data deleted. On endpoints: Copies of personal data left on laptops are often kept far longer than allowed."
},
{
"id": "control:GDPR:Art. 5(1)(f)",
"kind": "control",
"title": "GDPR Art. 5(1)(f) Integrity and confidentiality",
"text": "GDPR Art. 5(1)(f) (Integrity and confidentiality): Personal data must be protected against unauthorised access, loss and damage with appropriate measures. An auditor looks for: Technical security measures in place. On endpoints: The endpoint security baseline is part of these measures."
},
{
"id": "control:GDPR:Art. 25",
"kind": "control",
"title": "GDPR Art. 25 Data protection by design and by default",
"text": "GDPR Art. 25 (Data protection by design and by default): Build data protection into systems and use privacy-friendly settings by default. An auditor looks for: Privacy-protective default settings on devices and software. On endpoints: Telemetry and AI data-collection features should be off unless needed."
},
{
"id": "control:GDPR:Art. 28",
"kind": "control",
"title": "GDPR Art. 28 Processor",
"text": "GDPR Art. 28 (Processor): Use only processors that give sufficient guarantees, under a written contract with required terms. An auditor looks for: A data processing agreement with each processor. On endpoints: Cloud AI tools used with work data are processors and need an agreement."
},
{
"id": "control:GDPR:Art. 30",
"kind": "control",
"title": "GDPR Art. 30 Records of processing activities",
"text": "GDPR Art. 30 (Records of processing activities): Keep a written record of the processing activities you carry out. An auditor looks for: A current record of processing (RoPA). On endpoints: Processing done with endpoint tools, including AI tools, belongs in the record."
},
{
"id": "control:GDPR:Art. 32(1)(a)",
"kind": "control",
"title": "GDPR Art. 32(1)(a) Security of processing: pseudonymisation and encryption",
"text": "GDPR Art. 32(1)(a) (Security of processing: pseudonymisation and encryption): Where appropriate, protect personal data with pseudonymisation and encryption. An auditor looks for: Encrypted devices and removable media. On endpoints: Disk encryption is the standard measure for laptops holding personal data."
},
{
"id": "control:GDPR:Art. 32(1)(b)",
"kind": "control",
"title": "GDPR Art. 32(1)(b) Security of processing: confidentiality, integrity, availability and resilience",
"text": "GDPR Art. 32(1)(b) (Security of processing: confidentiality, integrity, availability and resilience): Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data. An auditor looks for: Access control, malware protection, patching and network protection on devices. On endpoints: Most endpoint baseline checks support this requirement."
},
{
"id": "control:GDPR:Art. 32(1)(c)",
"kind": "control",
"title": "GDPR Art. 32(1)(c) Security of processing: restore availability and access after an incident",
"text": "GDPR Art. 32(1)(c) (Security of processing: restore availability and access after an incident): Be able to restore access to personal data in time after a physical or technical incident. An auditor looks for: Working backups; Recovery keys available. On endpoints: Backups and disk-encryption recovery keys make restoration possible."
},
{
"id": "control:GDPR:Art. 32(1)(d)",
"kind": "control",
"title": "GDPR Art. 32(1)(d) Security of processing: regular testing and evaluation",
"text": "GDPR Art. 32(1)(d) (Security of processing: regular testing and evaluation): Regularly test, assess and evaluate whether security measures work. An auditor looks for: Periodic audits such as this one; Evidence that findings are followed up. On endpoints: Weekly audits and logging provide this evidence."
},
{
"id": "control:GDPR:Art. 33",
"kind": "control",
"title": "GDPR Art. 33 Notification of a personal data breach to the supervisory authority",
"text": "GDPR Art. 33 (Notification of a personal data breach to the supervisory authority): Report a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk. An auditor looks for: A breach procedure; Logs and accurate time to establish what happened. On endpoints: Security logs and time synchronisation make the 72-hour assessment possible."
},
{
"id": "control:GDPR:Art. 34",
"kind": "control",
"title": "GDPR Art. 34 Communication of a personal data breach to the data subject",
"text": "GDPR Art. 34 (Communication of a personal data breach to the data subject): Tell affected people about a high-risk breach without undue delay; encryption can remove this duty. An auditor looks for: Encryption that makes lost data unintelligible. On endpoints: Encrypted devices and media can avoid the need to notify individuals."
},
{
"id": "control:GDPR:Art. 35",
"kind": "control",
"title": "GDPR Art. 35 Data protection impact assessment",
"text": "GDPR Art. 35 (Data protection impact assessment): Assess the impact before processing that is likely to result in a high risk to people. An auditor looks for: DPIAs for high-risk processing. On endpoints: New tools with high-risk processing, such as AI used on employees, may need a DPIA."
},
{
"id": "control:GDPR:Art. 44",
"kind": "control",
"title": "GDPR Art. 44 General principle for transfers",
"text": "GDPR Art. 44 (General principle for transfers): Transfer personal data outside the EEA only under the conditions of Chapter V. An auditor looks for: A transfer basis (e.g. adequacy decision, standard contractual clauses) for non-EEA services. On endpoints: Cloud AI tools often process data outside the EEA."
},
{
"id": "control:EU AI Act:Art. 4",
"kind": "control",
"title": "EU AI Act Art. 4 AI literacy",
"text": "EU AI Act Art. 4 (AI literacy): Providers and deployers take measures so their staff using AI have a sufficient level of AI literacy. An auditor looks for: AI training for staff who use AI tools. On endpoints: AI tools found on endpoints show who needs AI literacy training."
},
{
"id": "control:EU AI Act:Art. 5",
"kind": "control",
"title": "EU AI Act Art. 5 Prohibited AI practices",
"text": "EU AI Act Art. 5 (Prohibited AI practices): Certain AI uses are banned, such as emotion recognition at work and in education (with narrow exceptions) and social scoring. An auditor looks for: No AI tools used for banned purposes. On endpoints: The purpose of each detected AI tool must be checked against the banned list."
},
{
"id": "control:EU AI Act:Art. 6",
"kind": "control",
"title": "EU AI Act Art. 6 Classification rules for high-risk AI systems",
"text": "EU AI Act Art. 6 (Classification rules for high-risk AI systems): An AI system is high-risk if it is a safety component of regulated products or is used for a purpose listed in Annex III. An auditor looks for: A risk classification for each AI system in use. On endpoints: Classification depends on what the tool is used for, not only on which tool it is."
},
{
"id": "control:EU AI Act:Art. 14",
"kind": "control",
"title": "EU AI Act Art. 14 Human oversight",
"text": "EU AI Act Art. 14 (Human oversight): High-risk AI systems must be designed so that people can oversee them effectively. An auditor looks for: Named, trained people overseeing each high-risk AI system. On endpoints: Applies only when a high-risk AI system is in use."
},
{
"id": "control:EU AI Act:Art. 26",
"kind": "control",
"title": "EU AI Act Art. 26 Obligations of deployers of high-risk AI systems",
"text": "EU AI Act Art. 26 (Obligations of deployers of high-risk AI systems): Deployers must use high-risk AI as instructed, assign human oversight, monitor it, keep logs and inform affected people. An auditor looks for: An AI register; Use according to instructions; Monitoring and log retention. On endpoints: The AI software inventory is the starting point for these duties."
},
{
"id": "control:EU AI Act:Art. 26(6)",
"kind": "control",
"title": "EU AI Act Art. 26(6) Deployers: keep automatically generated logs for at least six months",
"text": "EU AI Act Art. 26(6) (Deployers: keep automatically generated logs for at least six months): Deployers keep the logs a high-risk AI system generates, under their control, for at least six months unless other law says otherwise. An auditor looks for: Log retention of at least six months for high-risk AI systems. On endpoints: Only applies if a detected AI tool is used in a high-risk way."
},
{
"id": "control:EU AI Act:Art. 50",
"kind": "control",
"title": "EU AI Act Art. 50 Transparency obligations for providers and deployers of certain AI systems",
"text": "EU AI Act Art. 50 (Transparency obligations for providers and deployers of certain AI systems): People must be told when they interact with an AI system, and deepfakes and certain AI-generated text must be disclosed. An auditor looks for: Disclosure practices for chatbots and AI-generated content. On endpoints: Staff publishing AI-generated content need clear rules."
},
{
"id": "control:EU AI Act:Annex III",
"kind": "control",
"title": "EU AI Act Annex III High-risk AI systems referred to in Article 6(2)",
"text": "EU AI Act Annex III (High-risk AI systems referred to in Article 6(2)): Lists high-risk uses such as biometrics, critical infrastructure, education, employment and worker management, access to essential services, law enforcement, migration and justice. An auditor looks for: No unassessed use of AI for employment decisions, credit scoring or similar Annex III purposes. On endpoints: A general AI assistant becomes high-risk if used, for example, to screen job applicants."
},
{
"id": "tool:Microsoft Copilot",
"kind": "tool",
"title": "Microsoft Copilot (AI tool)",
"text": "Microsoft Copilot: Cloud AI assistant, provider Microsoft (US), data location: Microsoft cloud; enterprise plans keep data under Microsoft's commercial data protection terms. Default EU AI Act risk class for general office use: minimal. GDPR: Use the Microsoft 365 work account version covered by the organisation's Microsoft data processing terms; consumer Copilot is not covered. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:ChatGPT",
"kind": "tool",
"title": "ChatGPT (AI tool)",
"text": "ChatGPT: Cloud AI assistant, provider OpenAI (US), data location: Provider cloud outside the EEA unless an EU data residency plan is used. Default EU AI Act risk class for general office use: minimal. GDPR: Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Claude",
"kind": "tool",
"title": "Claude (AI tool)",
"text": "Claude: Cloud AI assistant, provider Anthropic (US), data location: Provider cloud outside the EEA. Default EU AI Act risk class for general office use: minimal. GDPR: Needs a commercial plan with a data processing agreement and a transfer basis (Art. 28, Art. 44). Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Claude Code",
"kind": "tool",
"title": "Claude Code (AI tool)",
"text": "Claude Code: AI coding assistant (command line), provider Anthropic (US), data location: Code and prompts sent to the provider's cloud. Default EU AI Act risk class for general office use: minimal. GDPR: Source code may contain personal data or secrets; use a commercial plan with a data processing agreement and keep secrets out of repositories. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Gemini",
"kind": "tool",
"title": "Gemini (AI tool)",
"text": "Gemini: Cloud AI assistant, provider Google (US), data location: Provider cloud. Default EU AI Act risk class for general office use: minimal. GDPR: Use the Workspace version under the organisation's Google data processing terms; consumer use is not covered. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Perplexity",
"kind": "tool",
"title": "Perplexity (AI tool)",
"text": "Perplexity: Cloud AI search assistant, provider Perplexity (US), data location: Provider cloud outside the EEA. Default EU AI Act risk class for general office use: minimal. GDPR: Needs an enterprise agreement and a transfer basis before work or personal data is entered. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Cursor",
"kind": "tool",
"title": "Cursor (AI tool)",
"text": "Cursor: AI code editor, provider Anysphere (US), data location: Code sent to the provider and its model providers unless privacy mode is enforced. Default EU AI Act risk class for general office use: minimal. GDPR: Enforce privacy mode through a business plan and sign a data processing agreement. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Windsurf",
"kind": "tool",
"title": "Windsurf (AI tool)",
"text": "Windsurf: AI code editor, provider US-based provider, data location: Code sent to the provider's cloud. Default EU AI Act risk class for general office use: minimal. GDPR: Use a business plan with a data processing agreement and zero-retention settings. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Ollama",
"kind": "tool",
"title": "Ollama (AI tool)",
"text": "Ollama: Local model runner, provider Open source (runs locally), data location: On the device; nothing leaves unless a cloud model is selected. Default EU AI Act risk class for general office use: minimal. GDPR: No transfer to a provider, but check each model's licence and keep the local API (port 11434) closed to the network. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:LM Studio",
"kind": "tool",
"title": "LM Studio (AI tool)",
"text": "LM Studio: Local model runner, provider Element Labs (runs locally), data location: On the device. Default EU AI Act risk class for general office use: minimal. GDPR: No transfer to a provider; check model licences and whether its local server is exposed. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:GPT4All",
"kind": "tool",
"title": "GPT4All (AI tool)",
"text": "GPT4All: Local model runner, provider Nomic AI (runs locally), data location: On the device unless optional data sharing is enabled. Default EU AI Act risk class for general office use: minimal. GDPR: Keep the optional data lake sharing switched off. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Jan",
"kind": "tool",
"title": "Jan (AI tool)",
"text": "Jan: Local model runner, provider Open source (runs locally), data location: On the device unless a cloud model is connected. Default EU AI Act risk class for general office use: minimal. GDPR: Check whether remote API providers are configured; if so, the cloud provider rules apply. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Msty",
"kind": "tool",
"title": "Msty (AI tool)",
"text": "Msty: Desktop AI client, provider Desktop app (local and cloud models), data location: Local, or the cloud provider of any connected model. Default EU AI Act risk class for general office use: minimal. GDPR: Treat connected cloud models like the corresponding cloud assistant. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Alpaca (Ollama client)",
"kind": "tool",
"title": "Alpaca (Ollama client) (AI tool)",
"text": "Alpaca (Ollama client): Desktop client for local models, provider Open source (runs locally), data location: On the device. Default EU AI Act risk class for general office use: minimal. GDPR: No transfer to a provider; check model licences. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Hugging Face models",
"kind": "tool",
"title": "Hugging Face models (AI tool)",
"text": "Hugging Face models: Local model files, provider Various model publishers, data location: On the device. Default EU AI Act risk class for general office use: minimal. GDPR: Record which models are present and their licences; the risk class depends on what the models are used for. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Meta AI",
"kind": "tool",
"title": "Meta AI (AI tool)",
"text": "Meta AI: Cloud AI assistant (built into WhatsApp, Instagram and Facebook apps), provider Meta (US), data location: Provider cloud outside the EEA. Default EU AI Act risk class for general office use: minimal. GDPR: Consumer service with no business data processing terms; do not share work or customer data in chats with Meta AI. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Grok",
"kind": "tool",
"title": "Grok (AI tool)",
"text": "Grok: Cloud AI assistant, provider xAI (US), data location: Provider cloud outside the EEA. Default EU AI Act risk class for general office use: minimal. GDPR: Consumer service; needs an enterprise agreement and a transfer basis before work or personal data is entered. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:DeepSeek",
"kind": "tool",
"title": "DeepSeek (AI tool)",
"text": "DeepSeek: Cloud AI assistant, provider DeepSeek (China), data location: Provider cloud in the People's Republic of China. Default EU AI Act risk class for general office use: minimal. GDPR: No EU adequacy decision for China and no business data processing terms; EU data protection authorities have restricted or investigated it. Do not use with work or personal data. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Character.AI",
"kind": "tool",
"title": "Character.AI (AI tool)",
"text": "Character.AI: AI companion chatbot, provider Character Technologies (US), data location: Provider cloud outside the EEA. Default EU AI Act risk class for general office use: limited. GDPR: Consumer entertainment chatbot; not suitable for work use. Users must be told they are talking to an AI (AI Act Art. 50). Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Replika",
"kind": "tool",
"title": "Replika (AI tool)",
"text": "Replika: AI companion chatbot, provider Luka (US), data location: Provider cloud outside the EEA. Default EU AI Act risk class for general office use: limited. GDPR: Consumer companion app that collects sensitive personal conversations and has been subject to EU data protection enforcement; not suitable for work use. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Otter",
"kind": "tool",
"title": "Otter (AI tool)",
"text": "Otter: AI meeting transcription, provider Otter.ai (US), data location: Provider cloud outside the EEA. Default EU AI Act risk class for general office use: minimal. GDPR: Records and transcribes other people's voices: needs a lawful basis and notice to meeting participants, plus a data processing agreement. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "tool:Grammarly",
"kind": "tool",
"title": "Grammarly (AI tool)",
"text": "Grammarly: AI writing assistant (keyboard and browser), provider Grammarly (US), data location: Provider cloud outside the EEA. Default EU AI Act risk class for general office use: minimal. GDPR: Reads everything typed where it is enabled, including personal data; use the business plan with a data processing agreement or disable it in work apps. Whether it is allowed at work depends on the organisation's approved AI tools list and on the purpose: some purposes make any AI tool high-risk or prohibited."
},
{
"id": "aiact:prohibited",
"kind": "control",
"title": "EU AI Act prohibited AI practices",
"text": "EU AI Act prohibited AI practices: Emotion recognition of employees or students (except for medical or safety reasons); Social scoring of people; Manipulative or exploitative techniques that cause significant harm; Untargeted scraping of facial images to build face recognition databases; Biometric categorisation inferring sensitive traits such as political views or sexual orientation."
},
{
"id": "aiact:high_risk_examples",
"kind": "control",
"title": "EU AI Act high-risk AI uses",
"text": "EU AI Act high-risk AI uses: Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions; Assessing creditworthiness or credit scores of individuals; Deciding access to education or grading students; Assessing eligibility for public benefits or essential services; Risk assessment and pricing in life and health insurance; Biometric identification of people."
},
{
"id": "aiact:limited_risk",
"kind": "control",
"title": "EU AI Act limited-risk AI (transparency duties)",
"text": "EU AI Act limited-risk AI (transparency duties): Chatbots and AI-generated content: people must be told they are dealing with AI, and published deepfakes or AI-written public-interest text must be labelled (Art. 50).."
},
{
"id": "aiact:minimal_risk",
"kind": "control",
"title": "EU AI Act minimal-risk AI",
"text": "EU AI Act minimal-risk AI: Drafting, summarising, translation, coding help and similar general productivity use.."
},
{
"id": "phone:screen_lock.enabled:ios",
"kind": "phone",
"title": "Where to find Passcode on iPhone",
"text": "Passcode on iPhone: Is a passcode set on this iPhone? Where to look: Settings › Face ID & Passcode (or Touch ID & Passcode). If it asks for your passcode before opening, one is set.",
"os": "ios",
"check": "screen_lock.enabled"
},
{
"id": "phone:screen_lock.enabled:android",
"kind": "phone",
"title": "Where to find Screen lock on Android",
"text": "Screen lock on Android: Which screen lock is set? Where to look: Settings › Security & privacy › Device unlock › Screen lock (names vary by phone maker)",
"os": "android",
"check": "screen_lock.enabled"
},
{
"id": "phone:screen_lock.timeout:ios",
"kind": "phone",
"title": "Where to find Auto-Lock on iPhone",
"text": "Auto-Lock on iPhone: What is Auto-Lock set to? Where to look: Settings › Display & Brightness › Auto-Lock",
"os": "ios",
"check": "screen_lock.timeout"
},
{
"id": "phone:screen_lock.timeout:android",
"kind": "phone",
"title": "Where to find Screen timeout on Android",
"text": "Screen timeout on Android: What is Screen timeout set to? Where to look: Settings › Display › Screen timeout. If there is also 'Lock after screen timeout', it should be Immediately.",
"os": "android",
"check": "screen_lock.timeout"
},
{
"id": "phone:mobile.passcode_strength:ios",
"kind": "phone",
"title": "Where to find Passcode strength on iPhone",
"text": "Passcode strength on iPhone: What kind of passcode do you use? Where to look: The code you type to unlock. Settings › Face ID & Passcode › Change Passcode › Passcode Options shows the choices.",
"os": "ios",
"check": "mobile.passcode_strength"
},
{
"id": "phone:mobile.passcode_strength:android",
"kind": "phone",
"title": "Where to find Screen lock strength on Android",
"text": "Screen lock strength on Android: What kind of screen lock do you use? Where to look: Settings › Security & privacy › Device unlock › Screen lock",
"os": "android",
"check": "mobile.passcode_strength"
},
{
"id": "phone:mobile.jailbreak_root:ios",
"kind": "phone",
"title": "Where to find Not jailbroken on iPhone",
"text": "Not jailbroken on iPhone: Has this iPhone been jailbroken? Where to look: Jailbreaking means deliberately modifying iOS to install apps outside Apple's control. If nobody did this on purpose, answer No.",
"os": "ios",
"check": "mobile.jailbreak_root"
},
{
"id": "phone:mobile.jailbreak_root:android",
"kind": "phone",
"title": "Where to find Not rooted on Android",
"text": "Not rooted on Android: Is this phone rooted or is its bootloader unlocked? Where to look: Rooting means deliberately giving apps full system access. If nobody did this on purpose, answer No.",
"os": "android",
"check": "mobile.jailbreak_root"
},
{
"id": "phone:mobile.app_sources:ios",
"kind": "phone",
"title": "Where to find Apps only from the App Store on iPhone",
"text": "Apps only from the App Store on iPhone: Where do the apps on this iPhone come from? Where to look: Settings › General › VPN & Device Management lists developer or enterprise profiles. Alternative app marketplaces appear as separate apps.",
"os": "ios",
"check": "mobile.app_sources"
},
{
"id": "phone:mobile.app_sources:android",
"kind": "phone",
"title": "Where to find Install unknown apps blocked on Android",
"text": "Install unknown apps blocked on Android: Is any app allowed to install unknown apps? Where to look: Settings › Apps › Special app access › Install unknown apps. Every app should show 'Not allowed'.",
"os": "android",
"check": "mobile.app_sources"
},
{
"id": "phone:mobile.usb_debugging:android",
"kind": "phone",
"title": "Where to find USB debugging off on Android",
"text": "USB debugging off on Android: Is USB debugging on? Where to look: Settings › System › Developer options › USB debugging. If you cannot find Developer options, they are off.",
"os": "android",
"check": "mobile.usb_debugging"
},
{
"id": "phone:mobile.find_my_device:ios",
"kind": "phone",
"title": "Where to find Find My iPhone on iPhone",
"text": "Find My iPhone on iPhone: Is Find My iPhone on? Where to look: Settings › [your name] › Find My › Find My iPhone",
"os": "ios",
"check": "mobile.find_my_device"
},
{
"id": "phone:mobile.find_my_device:android",
"kind": "phone",
"title": "Where to find Find My Device on Android",
"text": "Find My Device on Android: Is Find My Device (Find Hub) on? Where to look: Settings › Google › All services › Find My Device (called Find Hub on newer phones)",
"os": "android",
"check": "mobile.find_my_device"
},
{
"id": "phone:malware.antivirus:android",
"kind": "phone",
"title": "Where to find Google Play Protect on Android",
"text": "Google Play Protect on Android: Is 'Scan apps with Play Protect' on? Where to look: Play Store › your profile picture › Play Protect › Settings (gear icon)",
"os": "android",
"check": "malware.antivirus"
},
{
"id": "phone:vuln.pending_updates:android",
"kind": "phone",
"title": "Where to find Android security update on Android",
"text": "Android security update on Android: What is the Android security update date? Where to look: Settings › About phone › Android version › Android security update (or Settings › Security & privacy › Updates)",
"os": "android",
"check": "vuln.pending_updates"
},
{
"id": "phone:vuln.outdated_apps:ios",
"kind": "phone",
"title": "Where to find App updates on iPhone",
"text": "App updates on iPhone: Are automatic App Updates on? Where to look: Settings › App Store › App Updates",
"os": "ios",
"check": "vuln.outdated_apps"
},
{
"id": "phone:vuln.outdated_apps:android",
"kind": "phone",
"title": "Where to find App updates on Android",
"text": "App updates on Android: Are apps updated automatically? Where to look: Play Store › your profile picture › Settings › Network preferences › Auto-update apps",
"os": "android",
"check": "vuln.outdated_apps"
},
{
"id": "phone:gdpr.auto_updates:ios",
"kind": "phone",
"title": "Where to find Automatic iOS updates on iPhone",
"text": "Automatic iOS updates on iPhone: What do Automatic Updates show? Where to look: Settings › General › Software Update › Automatic Updates",
"os": "ios",
"check": "gdpr.auto_updates"
},
{
"id": "phone:gdpr.auto_updates:android",
"kind": "phone",
"title": "Where to find Automatic system updates on Android",
"text": "Automatic system updates on Android: Are system updates downloaded automatically? Where to look: Settings › System › Software updates (names vary: 'Auto download over Wi-Fi', 'Automatic system updates')",
"os": "android",
"check": "gdpr.auto_updates"
},
{
"id": "phone:gdpr.time_sync:ios",
"kind": "phone",
"title": "Where to find Date & time set automatically on iPhone",
"text": "Date & time set automatically on iPhone: Is 'Set Automatically' on? Where to look: Settings › General › Date & Time",
"os": "ios",
"check": "gdpr.time_sync"
},
{
"id": "phone:gdpr.time_sync:android",
"kind": "phone",
"title": "Where to find Date & time set automatically on Android",
"text": "Date & time set automatically on Android: Is 'Set time automatically' on? Where to look: Settings › System › Date & time",
"os": "android",
"check": "gdpr.time_sync"
},
{
"id": "phone:gdpr.backup_configured:ios",
"kind": "phone",
"title": "Where to find iCloud Backup on iPhone",
"text": "iCloud Backup on iPhone: Is iCloud Backup on? Where to look: Settings › [your name] › iCloud › iCloud Backup",
"os": "ios",
"check": "gdpr.backup_configured"
},
{
"id": "phone:gdpr.backup_configured:android",
"kind": "phone",
"title": "Where to find Google backup on Android",
"text": "Google backup on Android: Is phone backup on? Where to look: Settings › Google › Backup (or Settings › System › Backup; Samsung: Accounts and backup)",
"os": "android",
"check": "gdpr.backup_configured"
},
{
"id": "phone:gdpr.telemetry:ios",
"kind": "phone",
"title": "Where to find Analytics sharing minimised on iPhone",
"text": "Analytics sharing minimised on iPhone: Is 'Share iPhone Analytics' on? Where to look: Settings › Privacy & Security › Analytics & Improvements",
"os": "ios",
"check": "gdpr.telemetry"
},
{
"id": "phone:gdpr.telemetry:android",
"kind": "phone",
"title": "Where to find Usage & diagnostics sharing minimised on Android",
"text": "Usage & diagnostics sharing minimised on Android: Is 'Usage & diagnostics' on? Where to look: Settings › Google › All services › Usage & diagnostics (also check the phone maker's diagnostics option)",
"os": "android",
"check": "gdpr.telemetry"
},
{
"id": "phone:gdpr.lock_screen_previews:ios",
"kind": "phone",
"title": "Where to find Notification previews hidden when locked on iPhone",
"text": "Notification previews hidden when locked on iPhone: What is 'Show Previews' set to? Where to look: Settings › Notifications › Show Previews",
"os": "ios",
"check": "gdpr.lock_screen_previews"
},
{
"id": "phone:gdpr.lock_screen_previews:android",
"kind": "phone",
"title": "Where to find Sensitive notifications hidden when locked on Android",
"text": "Sensitive notifications hidden when locked on Android: What do notifications show on the lock screen? Where to look: Settings › Notifications › Notifications on lock screen (or Settings › Privacy)",
"os": "android",
"check": "gdpr.lock_screen_previews"
},
{
"id": "phone:aiact.os_ai_features:ios",
"kind": "phone",
"title": "Where to find Apple Intelligence external integrations restricted on iPhone",
"text": "Apple Intelligence external integrations restricted on iPhone: Is the ChatGPT extension in Apple Intelligence on? Where to look: Settings › Apple Intelligence & Siri › ChatGPT (only on iPhones that support Apple Intelligence)",
"os": "ios",
"check": "aiact.os_ai_features"
},
{
"id": "phone:aiact.os_ai_features:android",
"kind": "phone",
"title": "Where to find AI assistant access restricted on Android",
"text": "AI assistant access restricted on Android: Can the AI assistant use what is on your screen? Where to look: Gemini app › your profile picture › Settings › 'Screen context' / 'Use screen context' (other assistants have similar options)",
"os": "android",
"check": "aiact.os_ai_features"
},
{
"id": "status:all",
"kind": "status",
"title": "What the audit statuses mean",
"text": "Compliant: the setting meets the baseline. Non-Compliant: it does not meet the baseline. Pending: This item needs a further step before it can be judged. NotApplicable: This check does not apply to this device or configuration. Error: The value could not be read, so compliance is unknown. Re-run the collector as administrator/root (Windows: elevated PowerShell or SYSTEM; Linux/macOS: sudo) to collect the evidence."
},
{
"id": "faq:checks",
"kind": "faq",
"title": "How many checks the audit runs",
"text": "The audit catalog has 74 checks: Windows 64, Linux 56, macOS 56, iPhone 29, Android 30. They cover passwords and lockout, malware protection, firewall, screen lock, USB storage, administrator accounts, disk encryption, updates and known vulnerabilities, GDPR technical controls (backups, logging, remote access, telemetry and more), EU AI Act controls (AI tools found, shadow AI, risk classification) and 8 organisational controls."
},
{
"id": "faq:0",
"kind": "faq",
"title": "What the Devseis Endpoint Auditor is",
"text": "The Devseis Endpoint Auditor is a free, open-source, read-only check of a computer or phone against ISO 27001, GDPR technical controls and the EU AI Act. It reads security settings, compares them with a baseline, matches installed software against known vulnerabilities, and an AI auditor that runs on the device writes a report with findings, risk levels and fix steps. It is not a certification and not legal advice."
},
{
"id": "faq:1",
"kind": "faq",
"title": "Does the audit change anything?",
"text": "No. The audit only reads settings such as password rules, firewall, disk encryption and installed software. It never changes them. Administrator rights are requested because some settings can only be read by an administrator."
},
{
"id": "faq:2",
"kind": "faq",
"title": "Privacy: where do audit results go?",
"text": "Nowhere. Evidence and reports stay on the device. The app downloads only two things: the AI auditor model and a signed list of known vulnerabilities. Nothing about the device is uploaded. Chat history is stored only in this browser."
},
{
"id": "faq:3",
"kind": "faq",
"title": "How to run an audit of a computer",
"text": "A web page cannot read a computer's settings, so computers are audited with the free Devseis desktop app for Mac, Windows (beta) and Linux. Download it from the Download page, install it, click Run audit and enter the computer password once. The first run downloads the AI auditor; the audit then takes about 5 to 15 minutes and ends with a PDF report."
},
{
"id": "faq:4",
"kind": "faq",
"title": "How to install on a Mac",
"text": "Open the downloaded .dmg file and drag Devseis Endpoint Auditor to Applications. The first time, macOS says it could not verify the app because it is not yet notarised: click Done, then open System Settings, Privacy & Security, and click Open Anyway. After that it opens normally. It needs macOS 13 or newer."
},
{
"id": "faq:5",
"kind": "faq",
"title": "How to install on Windows",
"text": "Run the downloaded setup .exe. Windows SmartScreen shows 'Windows protected your PC' because the app is not yet code-signed: click More info, then Run anyway. Click Next, Install and Finish. When the audit starts, click Yes in the User Account Control prompt. The Windows version is a beta."
},
{
"id": "faq:6",
"kind": "faq",
"title": "How to install on Linux",
"text": "On Ubuntu, Debian, Linux Mint or Pop!_OS, double-click the .deb file and click Install. On other distributions, make the AppImage executable (Properties, Permissions, Allow executing file as program) and double-click it. The audit asks for the password with the normal desktop prompt."
},
{
"id": "faq:7",
"kind": "faq",
"title": "How the phone check works",
"text": "Phones are checked in the browser: open the Devseis page on the iPhone or Android phone and start the phone check. The browser detects what it can (system version, whether a screen lock is set up) and asks the rest with help on where to look in Settings. Every result is labelled detected or self-reported. The report can be saved or shared as a PDF."
},
{
"id": "faq:8",
"kind": "faq",
"title": "What self-reported and detected mean",
"text": "Detected means the browser or the app read the value itself. Self-reported means the user answered a question; the value was not verified on the device. Phone checks are mostly self-reported because browsers cannot read phone settings."
},
{
"id": "faq:9",
"kind": "faq",
"title": "What is in the audit report",
"text": "The report has a compliance score, the most important gaps, and for each problem: what was found, why it matters, the risk level, step-by-step fixes for that operating system, how to verify the fix, and the related ISO 27001, GDPR and EU AI Act references. It also lists AI tools found and their EU AI Act risk class."
},
{
"id": "faq:10",
"kind": "faq",
"title": "Does the auditor need internet?",
"text": "Only the first time, to download the AI auditor and the vulnerability list. After that audits and chat work offline. Pending security updates can only be checked online because they ask the vendor."
},
{
"id": "faq:11",
"kind": "faq",
"title": "Settings for organisations",
"text": "Before running audits, an organisation can edit baseline.conf (approved administrator accounts, approved AI tools, limits such as screen lock within 5 minutes) and organisational.conf (answers to 8 organisational questions such as record of processing, DPIA and breach procedure). The desktop app keeps them in its settings folder."
},
{
"id": "faq:12",
"kind": "faq",
"title": "The Devseis AI auditor model",
"text": "The assistant and the report writer are a small language model fine-tuned by Devseis from Qwen2.5 and run on the device with WebLLM. Audit verdicts are decided by rules in code, not by the model; the model explains, prioritises and writes, and every report answer is checked against the evidence before it is used."
},
{
"id": "faq:13",
"kind": "faq",
"title": "Who is Arx?",
"text": "Arx is the name of the Devseis security assistant and endpoint auditor (from the Latin for fortress). Arx answers questions about securing computers and phones, ISO 27001, GDPR and the EU AI Act, and audits devices: computers with the Devseis Endpoint Auditor desktop app, phones with the phone check in the browser. Arx runs on the device; nothing is uploaded."
}
]
}