C-01Workstations and servers
Remote management, hardware and software inventory, patching.
Report: patch status
C-02Mobile devices
Enrolment, security rules, remote wipe if a device is lost.
Report: compliant devices
C-03Logging and alerts
Central collection, detection rules, notifications.
Report: alerts and follow-up
C-04Email gateway
Phishing, spam and dangerous attachments filtered out.
Report: blocked messages
C-05Remote access
VPN for remote work and branch offices, based on role.
Report: active access
C-06Identities
Accounts, groups, two-factor authentication, arrivals and departures.
Report: MFA coverage
C-07Compliance and reporting
Mapping to frameworks, evidence, periodic reports.
Report: controls covered