ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 7.2: Secure physical assets: enforced configurations, endpoint protection, a data loss prevention strategy, encryption of sensitive devices and only authorised devices and services

What does 7.2 require?

All physical assets, from laptops and mobile devices to servers, network devices, ATMs, cameras and sensors, are configured to established standards, monitored for compliance and regularly reviewed. Endpoint protection such as anti-virus, sandboxing, attachment scanning, browser isolation, application whitelisting, anti-spyware and endpoint detection and response is deployed with timely, validated updates, and where a protection tool disrupts a system the institution assesses whether the disruption is systemic and keeps compensating controls if the tool is removed. A comprehensive data loss prevention strategy covers how data is stored, transferred, used and disposed of in proportion to sensitivity; assets holding sensitive or critical data have safeguards such as encryption and strong access control, with a process to identify assets needing stronger measures such as whole-disk encryption, a trusted platform module, filesystem-level encryption or a secure enclave; staff, contractors and third parties use only authorised devices, sensitive data is not stored on unauthorised devices which are detected and blocked from the corporate network, and access from corporate devices to unauthorised internet services that could move corporate data is prevented.