Three separate requirements, one overlapping set of controls. Here is exactly what each framework expects at the endpoint level, and where most businesses fall short without realizing it.
A business completes its ISO 27001 certification, wins a major client contract that required it, and considers the compliance work done. Eighteen months later, a laptop is stolen from an employee’s car. The device was never encrypted. The insurer reviewing the claim asks for evidence of the endpoint encryption policy required under the very certification the business already holds. The evidence does not exist, because the control was checked off on paper but never actually implemented.
This gap, between holding a certification and actually operating the controls it requires, is one of the most common and most expensive compliance failures businesses encounter. Endpoint security sits at the center of it, because laptops, phones, and desktops are where ISO 27001, PCI DSS, and cyber insurance requirements most directly overlap, and where documentation gaps are most easily exposed after an incident.
This guide breaks down exactly what each framework requires at the endpoint level, where the requirements overlap, and what a business actually needs in place, not just on paper, to withstand an audit or an insurance claim review.
93 Controls in ISO 27001:2022 Annex A, with endpoint devices addressed directly under control 8.1
12 High level requirements under PCI DSS, several of which apply directly to endpoint devices
3 Separate reviewers, an auditor, a QSA, and an insurer, who may each ask for endpoint evidence independently
Why Endpoint Security Has Become a Compliance Requirement, Not Just a Technical One
Endpoint security used to be framed almost entirely as an IT decision, which antivirus to buy, which laptops to issue. That framing no longer holds. ISO 27001 certification, PCI DSS compliance for any business handling card payments, and increasingly, cyber insurance underwriting, all now specify concrete requirements around how endpoint devices must be secured, monitored, and documented. A gap at the endpoint level is no longer just a security risk. It is a compliance failure with direct financial consequences.
What Counts as an Endpoint in a Compliance Context
For compliance purposes, an endpoint is any device that stores, processes, or accesses business data, company laptops and desktops, servers in some contexts, and increasingly, personal mobile devices used for work under a BYOD arrangement. Auditors and insurers are generally not concerned with brand or specification. They are concerned with whether each device that touches sensitive data has the required controls applied and documented.
ISO 27001 and Endpoint Devices: What Annex A 8.1 Actually Requires
ISO 27001:2022 organizes its 93 Annex A controls into four themes, organizational, people, physical, and technological. Endpoint protection sits within the technological theme, specifically under control 8.1, User Endpoint Devices, which requires that information stored on, processed by, or accessible through user endpoint devices is protected. In practice, this means documented policies covering device configuration, encryption, malware protection, and secure disposal, not simply having antivirus installed somewhere in the business.
The Statement of Applicability: Why You Can’t Skip Endpoint Controls Without Justification
ISO 27001 does not require every business to implement every one of the 93 Annex A controls. Organizations conduct a risk assessment and document which controls apply, and which do not, in a Statement of Applicability. The catch for most businesses is that endpoint device protection is very rarely a control that can be reasonably excluded, since almost every organization stores or processes sensitive information on laptops and phones. Excluding control 8.1 without strong justification is one of the fastest ways to fail an ISO 27001 audit.
PCI DSS and Endpoint Security: Where It Fits Across the 12 Requirements
PCI DSS organizes its requirements into six control objectives covering twelve specific requirements. Endpoint security touches several of these directly, maintaining a vulnerability management program through anti-malware software, protecting stored cardholder data through encryption, and implementing strong access control measures on any device that can reach the cardholder data environment. Under PCI DSS version 4.0, the standard places additional emphasis on continuous compliance, meaning these controls need ongoing evidence, not a one time setup.
Anti-Malware and EDR: What Both Frameworks Expect at the Endpoint Level
Both ISO 27001 and PCI DSS expect a documented, actively maintained anti-malware capability across endpoint devices. Neither framework mandates a specific product by name, but both increasingly expect protection that goes beyond basic signature based antivirus, particularly for businesses handling sensitive or regulated data, where Endpoint Detection and Response capabilities demonstrate a stronger control than antivirus alone.
Encryption at Rest: A Requirement Most Businesses Assume They Already Meet
Encryption of data stored on endpoint devices is a standard expectation under both frameworks, and one of the most commonly assumed rather than verified controls Ambsan’s team encounters during audits. Many businesses believe their laptops are encrypted because a setting was enabled once during setup, without confirming it remains active, applies to every device, or is centrally documented anywhere an auditor could review.
Why this matters
An unencrypted laptop is not just a security gap. During an ISO 27001 audit, a PCI DSS assessment, or a cyber insurance claim review, it is a documented control failure with a paper trail pointing directly back to the business.
Access Control and MFA on Endpoint Devices
Both frameworks expect role based access control and increasingly, multi factor authentication, applied at the device and application level, not just at the network perimeter. This includes privileged access management for administrator accounts and periodic access reviews confirming that only current, authorized personnel retain access to sensitive systems from their endpoint devices.
Patch Management and Vulnerability Scanning Timelines
PCI DSS specifies concrete cadences, vulnerability scanning at least quarterly, and penetration testing at least annually, for environments handling cardholder data. ISO 27001 takes a more risk based approach without fixed timelines, but auditors still expect a documented, consistently followed patch management process across endpoint devices. An informal approach, patching when someone remembers to, satisfies neither framework.
Logging and Monitoring: Why “We Have Antivirus” Isn’t Evidence
Having a security tool installed is not the same as having evidence it works. Both frameworks expect centralized logging and monitoring, PCI DSS specifically expects daily log review, that demonstrates endpoint activity is actually being watched, not simply that a tool exists somewhere on the network. This is one of the most common gaps Ambsan’s audits uncover, antivirus or EDR deployed correctly, but with no one reviewing what it reports.
Not sure whether your current setup would hold up under audit?
Book a free security assessment and Ambsan’s team will map your endpoint controls against the framework that matters to your business.
Mobile Device Management as a Compliance Control, Not Just a Security One
For businesses allowing personal devices to access company data, Mobile Device Management is increasingly treated as a compliance requirement rather than an optional convenience. It provides the documented enforcement, mandatory passcodes, remote wipe capability, encrypted work profiles, that auditors and insurers expect to see evidence of, particularly where regulated data may be accessed from a device the business does not own.
Cyber Insurance: Why Insurers Are Now Verifying Endpoint Controls Before Paying Claims
Cyber insurance underwriting has shifted significantly. Insurers increasingly require specific endpoint security controls, current anti-malware or EDR coverage, encryption, and documented patch management, as a condition of the policy itself, and are verifying those controls during claims review, not only at the point of sale. A business that represented having these controls in place when the policy was issued, but cannot produce evidence of them after an incident, risks a denied claim regardless of how the attack actually occurred.
The Documentation Gap: Having Controls vs Proving You Have Them
This is the theme running through every framework covered here. Auditors, QSAs, and insurance claims adjusters are not simply asking whether a business has good security. They are asking for evidence, policies, logs, configuration records, that specific controls were in place and operating at a specific point in time. A business can have genuinely strong endpoint security and still fail an audit or a claim review, if that security was never documented in a form a third party can verify.
Where ISO 27001 and PCI DSS Overlap on Endpoint Requirements
| Control area | ISO 27001 | PCI DSS |
|---|---|---|
| Anti-malware / EDR | Required under Annex A 8.1 and related technological controls | Required under vulnerability management objective |
| Encryption at rest | Expected as part of endpoint device protection | Required for stored cardholder data specifically |
| Access control / MFA | Required under identity and access management controls | Required under strong access control measures |
| Patch management | Risk based, no fixed timeline, but documented process expected | Quarterly vulnerability scans, annual penetration testing required |
| Logging and monitoring | Required under technological controls | Daily log review specifically required |
Common Endpoint Compliance Gaps Found During Ambsan’s Audits
- Encryption assumed to be active but never centrally verified across all devices
- Antivirus or EDR installed, but alerts never actually reviewed by anyone
- No documented process for revoking endpoint access when an employee leaves
- Personal devices accessing company data with no Mobile Device Management or policy in place
- Patch management happening informally, with no record an auditor could review
- Cyber insurance policy purchased based on a security questionnaire that no longer reflects reality
Building an Endpoint Security Program That Satisfies Multiple Frameworks at Once
Because ISO 27001, PCI DSS, and cyber insurance requirements overlap significantly at the endpoint level, businesses rarely need three separate compliance efforts. A single, well documented endpoint security program, covering encryption, access control, monitoring, and patch management with proper evidence retention, typically satisfies the large majority of what all three expect. The efficient path is building the controls once and mapping them to each framework’s specific documentation requirements, rather than treating each as an isolated project.
Find out where your compliance gaps actually are
Ambsan’s IT Audit and Endpoint Security teams review your current controls against ISO 27001, PCI DSS, and cyber insurance requirements, and show you exactly what evidence is missing.
Book a Free Security Assessment
Explore IT Audit Services
How Ambsan’s IT Audit and Endpoint Security Services Work Together
Ambsan’s IT Audit service is built to evaluate exactly this gap, not just whether security controls exist, but whether they are documented, consistently applied, and would hold up under a real audit or claims review. This work is paired directly with Ambsan’s Endpoint Security solutions, so gaps identified during an audit, missing encryption, unreviewed alerts, absent MDM policy, translate into an actual implementation plan rather than a report that sits unused.
For businesses pursuing ISO 27001 certification, preparing for PCI DSS assessment, or renewing cyber insurance coverage, this combined approach is typically far more efficient than treating each requirement as a separate project handled by a different vendor.
Talk to Ambsan before your next audit or policy renewal
Get a clear picture of your endpoint compliance posture across every framework that applies to your business.
Talk to Our Security Team
Frequently Asked Questions
Does ISO 27001 specifically require endpoint security?
Yes. ISO 27001:2022 Annex A includes control 8.1, User Endpoint Devices, which requires that information stored on, processed by, or accessible through endpoint devices is protected. This control can rarely be excluded from a Statement of Applicability, since most organizations process sensitive data on laptops and phones.
What endpoint controls does PCI DSS require?
PCI DSS requires anti-malware protection, encryption of stored cardholder data, strong access control measures, and regular vulnerability scanning and patching on any device that can access the cardholder data environment, with PCI DSS 4.0 emphasizing continuous, ongoing compliance rather than a one time setup.
Can a cyber insurance claim be denied over endpoint security?
Yes. Insurers increasingly verify that the endpoint security controls represented when a policy was purchased, such as anti-malware, encryption, and patch management, were actually in place and documented at the time of an incident. A gap between what was claimed and what can be evidenced is a common reason for denied claims.
Is antivirus enough to satisfy ISO 27001 or PCI DSS?
Basic antivirus can satisfy the minimum anti-malware expectation in some cases, but auditors increasingly look for evidence that alerts are actively monitored and responded to, not just that a tool is installed. For businesses handling more sensitive data, EDR is often expected as a stronger control.
How often does PCI DSS require vulnerability scanning?
PCI DSS requires vulnerability scanning at least quarterly and penetration testing at least annually for environments handling cardholder data, with additional scanning required after significant infrastructure changes.
Do personal devices need to comply with these frameworks too?
If a personal device accesses or stores company data covered under ISO 27001, PCI DSS, or a cyber insurance policy, it generally falls within the compliance scope, which is why Mobile Device Management and a documented BYOD policy are increasingly treated as compliance requirements.
What is a Statement of Applicability in ISO 27001?
The Statement of Applicability is a required document listing all 93 Annex A controls and whether each applies to the organization, with justification for any exclusions. It is one of the first documents an ISO 27001 auditor reviews.
How long does it take to close endpoint compliance gaps?
Timelines vary depending on the number of devices and the size of the gap, but straightforward gaps like enabling encryption or deploying MDM can often be addressed within weeks, while building full documentation and evidence retention processes typically takes longer.
Can one endpoint security setup satisfy multiple compliance frameworks at once?
In most cases, yes. ISO 27001, PCI DSS, and cyber insurance requirements overlap significantly at the endpoint level, so a well documented program covering encryption, access control, monitoring, and patch management typically satisfies the majority of what all three expect, with framework specific documentation layered on top.
Final Thoughts
Endpoint security compliance is rarely a technology problem. Most businesses already own reasonable security tools. The gap that causes audit failures and denied insurance claims is almost always documentation, controls that exist in practice but were never recorded in a form an auditor, assessor, or claims adjuster can verify after the fact.
ISO 27001, PCI DSS, and cyber insurance requirements overlap closely enough at the endpoint level that closing this gap once, properly documented and consistently maintained, tends to satisfy far more than any single framework in isolation.
Related: Black Box vs White Box vs Grey Box Penetration Testing, Which One Does Your Business Actually Need
Related: Antivirus vs EDR, Why Free Antivirus Won’t Stop 2026’s Ransomware
Related: BYOD in Pakistani Offices, Why the Personal Phone Every Employee Uses Is Your Weakest Endpoint
Ready to see where your compliance gaps actually are?
Book a free, no obligation consultation with Ambsan’s team and get a clear endpoint compliance roadmap.
Schedule a Consultation
See All Services
Ambsan Technologies is a Karachi based cybersecurity firm serving businesses across Pakistan and the United States, offering IT audit, endpoint security, and managed IT services for SMEs and enterprises.