The device part
of your audit.

Keep an inventory of your information and the devices that hold it.

XFA lists every device that signs in through it, with its owner and how it stands against your policy. Devices found in your Google, Microsoft, or Okta sign-in logs show up too.

Set rules for the acceptable use of information and devices, and put them into practice.

Your device rules become checks that run at every sign-in. The dashboard flags each device that doesn't meet them.

People get security awareness training and hear about changes to your policies.

When a device fails a check, the XFA app explains the check and how to fix it. Your training program still covers the rest.

Protect information when people work away from the office.

XFA checks the device itself, wherever it is. At home or on the road, every sign-in checks updates, the firewall, and disk encryption.

Protect information stored on or reached through laptops, phones, and tablets.

This is what XFA does. Set your device policy, such as disk encryption and screen lock, and XFA checks every laptop and phone against it.

Use secure ways to sign in.

XFA adds a device check to sign-in, so a password alone does not let a risky device in. Built-in Passkey adds phishing-resistant MFA.

Protect devices against malware.

The Antimalware protection check confirms protection is active. The Operating System version check keeps devices on a recent release.

Find technical vulnerabilities and act on them.

XFA compares each operating system and browser with the latest release and flags known vulnerabilities. You set how many days a device may fall behind.

Keep sensitive information from leaking out.

The Disk encryption check confirms the drive is encrypted, so the data on a lost or stolen laptop stays unreadable.

Know which assets reach your systems, as part of controlling access to them.

XFA reads the sign-in logs of your Google, Microsoft, or Okta account and lists each device it finds, whether it is company owned, personal, or a contractor's. XFA can invite the owners automatically.

Identify users and their devices, and let only authorized ones in.

XFA checks the device at sign-in through your identity provider. A device that fails your policy is warned or blocked, as you set it.

Prevent or detect malicious software, and act on it.

The Antimalware protection check confirms protection is on at every sign-in. Set it to block, and a device without it cannot reach the apps you protect.

Watch for configuration changes and new vulnerabilities, such as missing patches.

XFA checks the operating system and browser version at every sign-in and flags known vulnerabilities. The dashboard shows which devices fall behind.

Restrict how information moves and leaves, and protect it, often with encryption.

The Disk encryption check confirms the drive is encrypted. If a laptop is lost or stolen, its data stays unreadable.

Tell people about security and their part in your policies.

When a device fails a check, the XFA app tells its owner which one, why it matters, and how to fix it.

Apply basic cyber hygiene, such as software updates, device configuration, and identity management.

XFA checks updates, the firewall, screen lock, and disk encryption on every device at sign-in, company owned or personal.

Use multi-factor or continuous authentication where it fits.

Built-in Passkey gives phishing-resistant MFA at sign-in. Each sign-in also checks the device, so both the person and the laptop are verified.

Have policies on cryptography and, where it fits, encryption.

The Disk encryption check shows which devices are encrypted. Set it to block, and an unencrypted device cannot reach the apps you protect until it is fixed.

Manage the security risks that come from your suppliers and service providers.

Contractors often work on their own laptops. XFA finds those devices in your sign-in logs and checks them against the same policy, without taking control of them.

Train management and staff in cybersecurity.

When a check fails, the XFA app explains the setting and how to fix it. Your training for management and staff still does the rest.

Identify and document your ICT assets, endpoints included.

XFA keeps a current list of the devices that reach your systems, with owner and status. The list builds itself from sign-ins.

Limit access to ICT assets to what is authorized, through identity and access policies.

At sign-in, XFA checks the device against your policy. A device that fails a check is warned or blocked, as you set it.

Monitor and control the security of ICT systems, software vulnerabilities included.

XFA checks operating system and browser versions at every sign-in and flags known vulnerabilities.

Protect data with strong encryption, at rest and in transit.

The Disk encryption check covers data at rest on laptops and phones. A lost laptop with an encrypted drive keeps its data private.

Every device on the internet sits behind a firewall. Laptops need their own software firewall at home and on public Wi-Fi.

The Firewall status check confirms the firewall is on, at every sign-in.

Change insecure defaults, remove what you do not use, and lock devices that are left alone.

XFA checks that screen lock is set and that a password manager is installed. Your policy sets the longest screen lock timeout you accept.

Only authorized users and devices reach your data and services, with MFA where it is available.

XFA checks the device at sign-in, so access needs a known person on a device that meets your policy. Built-in Passkey adds phishing-resistant MFA.

Devices run active malware protection.

The Antimalware protection check confirms protection is running at sign-in. If it is off, the person sees how to turn it on, and the device can be blocked until they do.

Run supported software, and install critical and high risk updates within 14 days.

XFA checks the operating system and browser version at every sign-in. Set the days a device may fall behind to 14, and block after that if you want.

Any device that reaches your data is in scope, personal ones included. At home, the device itself is the boundary.

XFA checks personal devices without an MDM. It flags jailbroken or rooted phones and checks the firewall and updates on the device itself.

Keep an up to date inventory of the system components in scope, end user devices included.

XFA lists devices as they sign in, with owner and status, so the list stays current without a spreadsheet.

Run active anti-malware on the components that malware commonly affects.

Before a device reaches the apps you protect, XFA checks that antimalware protection is active.

Install critical security patches within one month of release.

Set how many days an operating system may fall behind. XFA warns the person, then blocks the device if you choose, until it is updated.

Use MFA for access into the cardholder data environment and for remote access.

Built-in Passkey gives phishing-resistant MFA at sign-in to the apps you connect, and every sign-in also checks the device.

Configure system components securely: change defaults, remove what you do not need, set security parameters.

XFA checks screen lock and the firewall on each device against your policy. A device that drifts is flagged, warned, or blocked.

Run a security awareness program, so everyone knows the card data security policy.

When a check fails, the XFA app tells the person what is wrong and how to fix it. That supports your awareness program. The program itself stays with you.

Restrict access to workstations that reach electronic patient data (ePHI), and secure them when unattended.

The Screen lock check confirms a lock is set, with the longest timeout you accept. A device without one can be blocked until it is fixed.

Encrypt ePHI where it is reasonable. The rule calls this addressable.

The Disk encryption check shows which devices are encrypted. Set it to block, and an unencrypted device cannot reach the apps you protect.

Have procedures to guard against, detect, and report malicious software.

XFA checks that antimalware protection is running and the operating system is up to date before a device reaches your systems.

Give access to ePHI only to the people and software that were granted it.

XFA adds the device to that decision. A known user on a device that fails your policy is warned or blocked, as you set it.

Review records of system activity, such as access reports.

XFA shows which devices reached your apps, when it last saw each one and how each stood against your policy. That list also feeds your risk analysis.

Guard ePHI against unauthorized access while it travels over a network.

The Firewall status check confirms each device's firewall is on, on public networks too. XFA does not check the network itself.

Send your staff periodic security updates.

When a device fails a check, XFA alerts its owner by email, and also in Slack or Microsoft Teams if you connect them. The alert repeats on the schedule you choose.

Use measures such as pseudonymisation and encryption of personal data.

The Disk encryption check confirms each device that reaches personal data is encrypted. A lost laptop then keeps that data unreadable.

Keep the systems that process personal data confidential, intact, available, and resilient.

Only devices that meet your policy reach those systems. A device with no screen lock or with the firewall off is warned or blocked.

Regularly test and evaluate whether your security measures work.

XFA checks each device at every sign-in, not once a year. The Overview shows how many devices met your policy over the last 30 days.

Build data protection into your systems, and make the safe setting the default.

Set a check to block, and a device that fails it does not reach personal data until it is fixed.

Be able to show that you follow the data protection principles.

The dashboard shows which devices reached your apps and how each stood against your policy. That is the device part of your evidence.

Keep an inventory of the hardware your organization uses.

XFA lists each device as it signs in, personal and contractor laptops included, with owner and status.

Identify, confirm, and record vulnerabilities in your assets.

XFA flags devices whose operating system or browser is out of date or has a known vulnerability, so you see the risk per device.

Manage identities and credentials for authorized users, services, and hardware.

XFA adds the device to each access decision. A known user on a device that fails your policy is warned or blocked.

Protect access with authentication that fits the risk, such as MFA.

Built-in Passkey gives phishing-resistant MFA, and each sign-in checks the device too.

Apply and maintain secure configuration baselines.

Your policy is the baseline. XFA checks screen lock, the firewall, and disk encryption against it and flags devices that drift.

Keep software maintained and patched in line with risk.

Set how many days an operating system may fall behind. After that, XFA warns or blocks the device until it is updated.

Protect the confidentiality, integrity, and availability of data at rest.

The Disk encryption check confirms the drive is encrypted, at every sign-in.

Monitor your environment for possible security events.

Every sign-in checks the device again, so protection that was switched off shows up the next time it signs in.

Set, communicate, and enforce a cybersecurity policy.

XFA turns the device part of your policy into checks. When a device fails a check, the XFA app tells the person what to fix and how.

Know the devices and systems in your organization.

XFA lists every device that signs in through it, with owner and status, and finds the rest in your Google, Microsoft, or Okta sign-in logs.

Control who and what gets access, remote access included.

XFA checks the device at every sign-in and warns or blocks one that fails a check. Built-in Passkey adds phishing-resistant MFA.

Protect data at rest and in transit.

The Disk encryption check covers data at rest on laptops and phones.

Keep a secure baseline configuration and manage vulnerabilities.

Your policy is the baseline: updates, screen lock, the firewall, and disk encryption. XFA flags devices that fall behind or have a known vulnerability.

Detect malicious code and watch for unauthorized activity.

The Antimalware protection check confirms protection is active at every sign-in.

Inform and train everyone who uses your systems.

When a check fails, the XFA app explains it and how to fix it. Your own training still covers the rest.