Requirements · Endpoint protection
Endpoint protection requirements for remote work, personal devices, Mac and Linux
Last updated 25 October 2026 · 3 sources listed · Reading time about 4 minutes
Short answer
Set requirements by device role rather than by operating system alone. Every device touching company data needs encryption, automatic updates, a screen lock and the ability to be located or wiped. Managed company devices add endpoint agents and central policy, while personal devices rely on app-level controls. Linux servers and Mac laptops need explicit coverage, not assumed immunity.
Who this is for: An IT or operations lead whose staff work from home or use their own devices and who must set a consistent minimum standard across Windows, Mac, Linux and mobile.
What to evaluate
Baseline configuration
Many compromises exploit missing updates and unlocked or unencrypted devices rather than clever malware.
How to check: Verify full-disk encryption, automatic updates and screen lock timeout are enforced by policy, not left to user choice.
Management enrolment
Without enrolment you cannot enforce settings, inventory devices or remove data when someone leaves.
How to check: Confirm each device class can be enrolled and report compliance status to a central system.
Platform-specific protection
Mac and Linux face different threats and offer different built-in controls, and agent features rarely match across platforms.
How to check: Read the feature matrix for each platform and test the agent on the actual versions you run.
Separation of work and personal data
Personal devices should not become a route for company data to spread, nor should the company see private content.
How to check: Check whether app-level containers or work profiles are available, and what an administrator can and cannot see.
Home network exposure
Home routers and shared networks are outside your control, so the device itself must resist local attack.
How to check: Require host firewalls on, advise on router updates, and use secured connections to company resources.
Loss, theft and departure handling
Remote and personal devices disappear more often and leave with staff.
How to check: Test remote lock and wipe, and write down who triggers them and how quickly.
Comparison
| Device type | Minimum controls | Watch out for |
|---|---|---|
| Company-owned laptop, any platform | Enrolment, encryption, enforced updates, endpoint agent, remote wipe | Local admin rights granted too widely |
| Personally owned laptop | Encryption check, patched system, browser or virtual access to work apps rather than local data | Inability to enforce policy and mixed family use |
| Personally owned phone | Screen lock, work profile or managed app container, ability to remove work data only | Staff resisting intrusive controls on private devices |
| Linux server or workstation | Hardened configuration, patch process, host firewall, logging, endpoint agent where supported | Assuming it is safe because of the operating system |
| Shared or kiosk device | Locked-down profile, automatic cleanup, no cached credentials | Persistent sessions left signed in |
Decision worksheet
Rate up to three options against this guide’s own criteria. It runs in your browser and saves only on this device. It is a thinking aid, not a recommendation.
1. Have you checked each criterion?
0 of 6 criteria checked.
2. Compare options (0 = fails or unknown, 3 = meets it well)
| Criterion | |||
|---|---|---|---|
| Baseline configuration | |||
| Management enrolment | |||
| Platform-specific protection | |||
| Separation of work and personal data | |||
| Home network exposure | |||
| Loss, theft and departure handling | |||
| Total (max 18) | 0 | 0 | 0 |
Questions to ask before you commit
- Does the agent support our specific Mac and Linux versions with the same features as Windows?
- What can an administrator see on a personally owned device and how is that disclosed to staff?
- Can we remove only company data and leave personal content untouched?
- How does the console report devices that have not checked in for a long time?
- Can access to company applications be blocked automatically when a device falls out of compliance?
- What is the process when an employee reports a lost device outside working hours?
- How are kernel or system extension changes on Mac handled during operating system updates?
- Does the product support the container or virtual machine workloads we run on Linux?
Typical trade-offs
Bring your own device versus company-supplied equipment
- Upside
- Own-device models reduce hardware spending and suit staff who prefer their own tools.
- Downside
- You trade away configuration control and carry more privacy and support complexity.
Full device management versus app-level management
- Upside
- Full management enforces everything and gives complete inventory.
- Downside
- Staff often reject it on personal devices, whereas app-level control is lighter but covers less.
Conditional access blocking versus advisory warnings
- Upside
- Blocking non-compliant devices closes the gap automatically.
- Downside
- Lockouts frustrate users and require a quick, well-staffed remediation path.
Common mistakes
- Assuming Mac and Linux machines need no protection. Apply the same baseline and verify agent coverage on each platform.
- Writing a policy that cannot be enforced technically. Pair each requirement with a mechanism that reports compliance.
- Granting local administrator rights as a default for convenience. Provide an approved elevation process instead.
- Skipping the privacy conversation on personal devices. Publish clear terms on what is monitored to avoid disputes.
- Forgetting offboarding. Remove access, wipe company data and recover or verify devices on the day someone leaves.
Related questions
Do Mac computers really need endpoint protection?
Yes, in a business setting. Built-in protections are decent, but they do not give you central reporting, response actions or consistent policy across a mixed fleet. Attacks against Mac users commonly use phishing, malicious installers and credential theft, which operating system design does not fully prevent. Include Mac devices in enrolment, patching and endpoint monitoring, and check that the chosen product offers features on Mac comparable to those on Windows rather than a reduced version.
What is a reasonable approach to personal devices accessing work email?
Allow access through managed apps or a work profile that can be removed independently of personal content, require a screen lock and current operating system, and block access from devices that fail checks. Avoid storing company files locally where possible by using browser access or controlled apps. Explain to staff in plain language what the company can and cannot see. Employment and privacy rules differ by jurisdiction, so involve legal or HR advice when writing the policy.
How should Linux systems be protected?
Begin with hardening and maintenance: minimal installed packages, prompt patching, restricted remote login, host firewall and central logging. Add an endpoint agent where one is supported for your distribution, confirming performance impact on production workloads. For containers and cloud instances, protection often shifts toward image scanning and runtime monitoring rather than traditional antivirus. Document who owns patching, because Linux systems are often forgotten in asset lists and run unattended for long periods.
Is a VPN enough to secure remote workers?
A private connection protects traffic in transit but does nothing about a compromised or unpatched device that connects through it. Remote staff need the device-level controls described here plus strong authentication to company services. Some organisations move toward per-application access with device checks instead of broad network access. Whichever model you use, treat the endpoint as the true security boundary and verify its health before granting access to sensitive systems.
Sources and further reading
These pages were reachable when we last checked. They informed definitions and rules referred to above; they do not endorse this guide. Where rules differ by country, check the authority for your location.
- Device Security Guidance — National Cyber Security Centre (UK), retrieved 27 October 2026
- Mobile Device Guidance — National Cyber Security Centre (UK), retrieved 27 October 2026
- Cybersecurity Best Practices — Cybersecurity and Infrastructure Security Agency, retrieved 27 October 2026
Related guides
How to choose · Endpoint protection
How to choose endpoint protection for a small business
Pick endpoint protection by matching detection capability to the staff you actually have. Without anyone to watch alerts, favour strong automatic prevention, simple policy management and a response option that is either automated or provided by a service. Confirm operating system coverage, central management, tamper resistance and exportable logs before looking at extras.
Comparison · Endpoint protection
Antivirus vs EDR vs XDR: what each actually does
Traditional antivirus mainly blocks known malicious files and some suspicious behaviour. Endpoint detection and response records what happens on devices so analysts can investigate and contain intrusions. Extended detection and response correlates that endpoint data with identity, email, network and cloud signals. Each adds visibility and also adds work, so match the category to the people who will operate it.
Cost factors · Endpoint protection
What drives the cost of endpoint protection
Endpoint protection cost depends on device count, which capability tier you license, data retention, any managed monitoring, and the staff time required to run it. Quotes that look similar can hide different definitions of a device, different support levels and add-on modules. Compare total operating effort, not only the licence line.
Requirements · Network security
Network segmentation and remote access requirements for a small office
A small office should separate staff devices, guests, servers and untrusted internet-of-things equipment into distinct network zones, with a firewall controlling traffic between them. Secure administration, change default credentials, update router and access point firmware, require strong authentication for remote access and keep logs. Simple, consistently applied rules beat elaborate designs nobody maintains.
Requirements · Business operations
Requirements a restaurant POS must meet for tax, receipts and compliance
A POS must calculate the correct tax on each item, keep audit-friendly records, produce compliant receipts, protect card and staff data and support the record retention your authorities require. Some countries mandate certified fiscal devices. Rules differ by jurisdiction, so check with your tax authority and an adviser, then verify the vendor supports your local requirements.
Comparison · Identity and access
Passkeys, authenticator apps, hardware keys and text message codes compared
Methods differ mainly in how resistant they are to phishing and in how easy they are to deploy and recover. Passkeys and hardware security keys bind sign-in to the genuine site and resist phishing. Authenticator app codes are a solid, widely supported middle option. Text message codes are better than a password alone but are exposed to interception and number takeover, so reserve them as a fallback.
Requirements · Cloud security
Foundational requirements for securing a cloud account structure
A secure cloud foundation separates environments into distinct accounts, protects the top-level identity with strong authentication, centralises identity through a single directory, turns on audit logging in a protected location and sets organisation-wide guardrails. Doing these early is far easier than retrofitting them after teams have built on a flat, shared account.