Device security questions in a vendor questionnaire
Device questions ask whether laptops are encrypted, kept up to date and manageable when lost. A small team can answer them with a few settings that take an hour to change.
What the client wants to know
Laptops are where client data ends up in practice. The client wants to know that a lost or stolen laptop does not leak anything, that updates are installed, and whether personal devices (BYOD) can touch their data. Critical updates installed quickly are a detail they look for.
The 8 questions as clients phrase them
The kit covers 8 questions in this area. The wording varies between questionnaires, the control behind it does not.
- Are company laptops and workstations encrypted?
- How do you keep operating systems and software up to date?
- Do you use anti-malware or endpoint protection?
- What happens if a laptop is lost or stolen?
- Are company devices centrally managed (MDM)?
- Can you remotely lock or wipe a lost or stolen device?
- Are personal devices (BYOD) allowed to access our data?
- How quickly are critical security patches applied to devices?
What a good answer contains
- Encryption: full-disk encryption (FileVault on macOS, BitLocker on Windows) on every work laptop, plus an automatic screen lock.
- Updates: automatic updates on for the operating system and browsers on all work devices.
- Anti-malware: built-in protection of current operating systems counts, kept current through automatic updates.
- Lost device: the disk is encrypted, the loss is reported at once, passwords and sessions are revoked, the incident process is followed.
- MDM and remote wipe: if work laptops are enrolled in device management, say it enforces encryption, screen lock and updates. If not, say it is planned.
- BYOD: pick one honest answer. Either client data is accessed only from company devices, or personal devices must meet stated conditions.
Watch out for
Do not answer yes to remote wipe if you have no device management. The honest answer is that the encrypted disk protects the data and all sessions are revoked, with remote wipe planned.
Controls behind these answers
These are the controls the free Security Overview builder asks about for this area. Each line is the statement you can make once the control is in place, followed by the fix step if it is not.
- Devices: Every work laptop has full-disk encryption and an automatic screen lock. If not yet: Switch on FileVault (macOS) or BitLocker (Windows) and a screen lock of 5 minutes or less on every work laptop.
- Devices: Operating system and browser updates install automatically on work devices. If not yet: Switch on automatic updates for the operating system and browsers on every work device.
- Devices: Work laptops are centrally managed, so encryption, screen lock and updates are enforced and a lost device can be locked or wiped remotely. If not yet: Enroll work laptops in a device management tool (for example the one included in Google Workspace or Microsoft 365 business plans) and enforce encryption, screen lock and updates.
Example: how a prepared answer opens
Question: How do you keep operating systems and software up to date?
Automatic updates are switched on for operating systems and browsers on all work devices.
This is the first sentence only. In the kit the full answer is built from your profile, with an honest variant for each control you do not have yet.
Guidance and templates, not legal advice. The kit does not certify you. Your answers must match what you actually do.