Category
Control
ID
Audit Question /
Requirement
Physical
A.7.8
Is the device
physically labeled
with an asset ID?
Asset Tag #
A.7.7
Is the screen set to
auto-lock (max 5
mins)?
Screen Timeout
setting
A.8.2
Are local "Guest"
accounts disabled?
System User List
A.8.2
Does the user have
Standard (NonAdmin) rights?
User Account Type
A.8.5
Is Multi-Factor
Authentication
(MFA) active?
MFA Provider
name
A.8.19
Is the OS version
currently supported
and patched?
Build/Version
Number
A.8.7
Is Anti-Malware
active and
definitions up to
date?
Last Scan Date
A.8.23
Is a web filter or
"Safe Browsing"
enabled?
Browser/DNS
settings
A.8.1
Is Full Disk
Encryption (FDE)
active?
BitLocker/FileVault
status
A.8.13
Is the machine
regularly backed up
to the cloud/NAS?
Last Backup Date
Access
Software
Data
Pass/Fail
Evidence /
Comment
Category
Control
ID
Audit Question /
Requirement
Network
A.8.20
Is the local system
firewall turned ON?
Firewall status
A.8.22
Is a VPN used for
remote/public
connections?
VPN Client Name
Pass/Fail
Evidence /
Comment
0
