Most compliance frameworks do not mandate endpoint detection and response (EDR) by name. They require outcomes: protection from malicious code, monitoring, logging and incident response. EDR can help you evidence those outcomes, but you must map it to the exact control text and keep records. The US federal government is an exception.
Where is EDR actually required?
The clearest case is US federal agencies. OMB memorandum M-22-01, issued October 2021 under Executive Order 14028, directs agencies to adopt EDR and describes it as combining real-time continuous monitoring and collection of endpoint data with rules-based automated response and analysis. It also sets up a central EDR initiative run by CISA for host-level visibility across federal systems.
That memo applies to federal agencies. It is not a rule for private companies, though contractors that handle federal data may meet its influence through contract terms.
What do other frameworks say?
Language differs, so read the text for your version.
- NIST SP 800-171 protects controlled unclassified information in nonfederal systems. Its system and information integrity family includes a requirement to provide protection from malicious code, and another for security monitoring. A product choice is not specified.
- HIPAA Security Rule requires a risk analysis and technical safeguards, and includes procedures for guarding against malicious software as part of security awareness. It does not name EDR. Confirm wording in the current regulation text on the HHS site or eCFR.
- PCI DSS has a requirement to protect all systems and networks from malicious software. Check the current version of the standard for what it asks you to show on workstations and servers.
- SOC 2 and ISO 27001 are criteria and controls that you define and test. An auditor will want to see the control, the scope, and evidence that it operated.
The pattern is the same everywhere. The framework states a goal, you choose the tool, and the audit looks at coverage and evidence.
What does an auditor want to see?
A constructed example: a 200 person software company is preparing for an audit. They have an EDR agent on laptops. The auditor asks three questions.
- Coverage. What percent of in-scope devices run the agent? The company exports a device list from its management system and compares it with the agent console. Thirty servers turn out to be missing.
- Operation. Are alerts reviewed? The company shows a weekly review log and two examples of tickets from alert to closure.
- Response. What happens when a device is isolated? A written runbook and one tabletop exercise note answer this.
The tool existed before. What was missing was the proof around it.
What are common compliance gaps?
- Agents installed on laptops but not on servers, virtual machines or contractor devices.
- Detections in monitor-only mode with nobody assigned to review them.
- No documented link from the control statement to the tool.
- Logs retained for fewer days than the policy states.
- Exceptions granted informally, such as an executive who declined the agent.
What if the auditor asks for EDR specifically?
Sometimes a customer contract or a questionnaire names EDR even when the framework does not. In that case the contract is your requirement, so quote the clause, scope it to the systems it covers and answer it directly. If the wording is vague, such as "endpoint protection", ask what evidence they expect before you commit. Keep the answer consistent across questionnaires: the same tool names, the same scope and the same enrollment figures, so that no two documents you sign contradict each other.
How to check or apply this
- Get the exact control wording for each framework you are audited under.
- Write one sentence per control: which tool, which scope, who reviews.
- Reconcile device inventory against agent enrollment monthly and record the result.
- Keep alert review records and a tested response runbook.
- Document every exception with an owner and an end date.
Quick check
Is antivirus enough for the malware requirements?
It depends on the framework text and your risk assessment. Some auditors accept it, others expect behavior-based detection. Ask your auditor early and record the answer.
Does having EDR make us compliant?
No. Compliance is a determination about your whole program. EDR is one control that can produce evidence for several requirements.
Sources
- OMB M-22-01, Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response
- NIST SP 800-171 Rev. 2
- PCI Security Standards Council document library
Last reviewed: 18 October 2026.
