Endpoint Protection Policy¶
Purpose. Protect Soon's laptops — the only devices we operate — against malware and malicious websites. Absorbs the former Web Filtering Policy.
1. Scope¶
All laptops used to access Soon systems or data, company-provided or BYOD (see the Device Management Policy). Soon runs no servers of its own; server-side protection is covered by the AWS shared-responsibility model and the Cloud & Infrastructure Security Policy.
2. Policy¶
2.1 Endpoint protection¶
- Every laptop must run endpoint protection: at minimum the OS-native protection (e.g. macOS XProtect/Gatekeeper, Microsoft Defender), kept enabled and up to date. Soon relies on macOS XProtect and Gatekeeper (OS-native), verified each quarter via the device attestation in ISMS-DOC-A08-1-3 §4. Formerly asked whether a managed EDR is deployed.
- Users must not disable or bypass endpoint protection.
2.2 Least privilege and software sources¶
- Daily work must not be done with a local administrator account; admin rights are used only when needed for installation or configuration.
- Software may only be installed from approved sources (official vendor sites, OS app stores) and per the Software Policy. Pirated or unknown-origin software is prohibited.
2.3 Updates¶
- OS and browser auto-updates must be enabled on all laptops. Security updates must be installed promptly, not deferred indefinitely.
2.4 Malicious-site and phishing protection¶
- Browser-level protection against malicious sites (e.g. Google Safe Browsing / Microsoft SmartScreen) must remain enabled.
- No DNS-level filtering is in place; this is accepted at current size and revisited alongside the MDM trigger in ISMS-DOC-A08-1-3 §1.1.
- All personnel receive phishing awareness as part of security awareness training and must report suspected phishing per the Information Security Event Reporting Procedure.
2.5 Suspected infection¶
- If malware is suspected, the user must disconnect the device from work accounts, report immediately per the event reporting procedure, and not attempt to "clean" the device themselves before reporting.
3. Roles & responsibilities¶
- All personnel: keep protections enabled, install software only from approved sources, report suspicious activity.
- Security responsible: selects endpoint protection tooling, verifies compliance periodically, handles reported events.
4. Related documents¶
- Device Management Policy
- Software Policy
- Information Security Event Reporting Procedure
- Cloud & Infrastructure Security Policy
Change log¶
| Version | Date | Author | Comments |
|---|---|---|---|
| 0.1 | 2023-10-23 | Olaf Jacobson | First draft document |
| 0.2 | 2026-07-18 | Andrea Cardinali | Rewritten lean and Soon-specific (ISMS overhaul); absorbs the Web Filtering Policy |