IT-4 Workstations – OS

What is IT-4 Workstations – OS Control?

IT-4 Workstations – OS control talks about how both your software and hardware must be protected from potential threats. Antivirus solutions are typically the most commonly used tools to protect workstations and software, including the OS (operating system).

Available tools in the marketplace

The following listing is “crowdsourced” from our customer base or from external research. TrustCloud does not personally recommend any of the tools below, as we haven’t used them.

Asset Monitoring / Endpoint Security Tools

Jamf (Mac-specific)

Mosyle (Mac-specific)

Kolide

Rippling

Duo

OSQuery (free, open source)

Available templates

TrustCloud has a curated list of templates, internally or externally sourced, to help you get started. Click on the link for a downloadable version:

• N/A: no template for this control

Control implementation

NOTE: This control is 100% automated by TrustCloud. Connect your system to enjoy the benefits of automation.

To implement IT-4 Workstations – OS control manually:

Install a centralized antivirus solution on all hardware (i.e., workstations). If some of the devices are not managed by the centralized solution, ensure that a BYOD policy exists (Bring Your Own Device) to shift the liability and responsibility for OS security to the end user and not to the organization.

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action:

1. Provide a screenshot of the antivirus policies and a list of connected workstations.
2. Provide screenshots of the antivirus policies and a list of connected devices.

Evidence example

For the suggested action, an example is provided below:

1. Provide a screenshot of the antivirus policies and a list of connected workstations.
   The following screenshot shows the TrustCloud example showing the policies for one “device”.
   
2. Provide screenshots of the antivirus policies and a list of connected devices.
   The following screenshot shows the antivirus policies and a list of connected devices.