For a remote team, SOC 2 endpoint controls come down to four things: know which laptops exist, encrypt their disks, keep them patched and locked, and be able to wipe a lost one. Write the standard down, enforce it with device management where you can, and keep dated evidence.
Why endpoints matter to the audit
The criteria do not mention laptops by name. They ask you to protect information assets, restrict logical access and guard against malicious software. A company laptop with production access is an asset in scope, so auditors ask how you manage it.
Remote teams get more questions here because there is no office to point at.
The minimum control set
- Inventory. A list of company devices, who has each one, and the date issued and returned.
- Disk encryption. Turned on and checked, not just promised.
- Screen lock. A short idle timeout and a password or biometric to unlock.
- Operating system updates. A rule for how soon security updates are installed.
- Malware protection. Whatever your platform requires, applied and monitored.
- Lost or stolen device process. Report it, revoke access, wipe if possible, and log it.
- Personal devices. Either forbid access to production data from them, or define what they must meet.
Evidence that works
Screenshots of a settings page prove little by themselves. Better evidence comes from a device management export that shows each laptop, its encryption state and its update status, with a date. Take one export at the audit date for Type 1, and one per quarter across the period for Type 2.
For a team that does not use device management yet, a signed device checklist at issue time plus a periodic self check is a weak but accepted start. Plan to move to central management.
Edge cases to decide up front
- Contractors on their own machines. Require the same baseline or give them a company device.
- Shared or lab machines. Treat them as in scope if they can reach production.
- Linux workstations used by engineers. Write down how encryption and updates are checked for them, because many tools cover them poorly.
- Mobile phones with email or chat access. Decide if they are in scope and, if so, how you check them.
Tie it to access
Endpoint health is more useful when it feeds access. If your identity provider can block sign in from a device without encryption, that single control often satisfies several test points and removes a lot of manual checking.
Safeguard's asset discovery can help find what is connected and in use, and its compliance and evidence automation can keep records dated. Device management is still the system of record for laptop settings.
Quick check
Do we need antivirus on every laptop?
Your policy decides. The criteria ask you to prevent and detect malicious software. State what you use per platform and show it is running.
Can we allow personal laptops?
Yes, if you define the minimum standard and can show it is met. Many small teams find company owned devices simpler to evidence.
Last reviewed: 19 October 2026.
