Before your back office loads, XFA checks the laptop against the settings PCI DSS and DORA ask for, contractors' laptops included. You decide which checks warn and which block.
Free to start for your whole team: 4 device checks at every sign-in, and people are guided to fix issues themselves, automatically or by hand.
Our partner bank wants to know who can reach the back office, and from which laptop.
The auditor wants proof that every laptop with access is encrypted and patched. We have a spreadsheet.
Half the team works from home part of the week. The contractors brought whatever laptop they had.
DORA applies to us now. It wants every laptop on the asset register.
Your auditor reads PCI DSS or DORA as a list of controls. A few of them are about the laptops your people work on. The table pairs each of those with the check XFA runs at sign-in.
For anyone who stores, processes, or transmits card data, or can reach the systems that do.
Req. 1.5.1
Security controls on any device, company or employee owned, that reaches both the internet and the cardholder data environment.
The firewall is on.
Req. 5.2.1
Anti-malware on every system component, unless a periodic evaluation shows it is not at risk.
Antimalware is installed and active.
Req. 6.3.3
Security patches installed, the critical ones within a month of release.
No operating system update is left waiting, and automatic updates are on.
Req. 8.2.8
A session left idle for more than 15 minutes asks the person to sign in again.
Screen lock is on, and its timeout is set.
Req. 8.4.2
Multi-factor authentication for all non-console access into the cardholder data environment.
Built-in Passkey can be the second factor at your identity provider. It is phishing-resistant MFA that the XFA app answers in the background, and the device is checked in the same moment.
Req. 12.5.1
A current inventory of the system components in scope.
A list of every device found in your identity provider's sign-in logs, with its owner and its check results.
For EU financial entities, payment and e-money institutions, and crypto-asset service providers among them. Their ICT providers meet it through their contracts.
Art. 8(1)
ICT assets identified and documented, laptops included.
The device list in the dashboard shows each laptop found in your sign-in logs, who it belongs to, and which checks it passes.
Art. 9(1)
The security of ICT systems monitored and controlled.
Where known vulnerabilities are checked, each device's operating system and browsers are checked for them.
Art. 9(2)
Confidentiality of data, at rest included.
Disk encryption is on.
Art. 9(4)(c)
Access to ICT assets only for approved functions.
Set a check to block, and a laptop that fails it waits at sign-in until the setting is right.
Art. 9(4)(f)
Patches and updates handled under a documented policy.
Operating system updates are current, automatic updates are on, and the browser is up to date.
Write one policy for the back office and the card data environment. It says which checks warn, which block, and after how many days. Every laptop that signs in to either is checked against it.
Gateway.fm builds Web3 infrastructure and is not a financial company. Its team is spread out, with many contractors on personal laptops. It prepared for SOC 2 and ISO 27001 with Vanta.
“I first installed it on my device to see how it works. When I verified that actually it is what it claims (that there is no privacy invasion) it was easier to be an ambassador and explain it to everyone in the team.”
Alex UlyanovHead of Security, Gateway.fmRead the Gateway.fm storyXFA checks security settings and nothing else. Nothing on the laptop changes unless its owner says yes.
Visit our Trust Center (opens in a new tab)
ISO 27001 certified
GDPR compliant
No tool does that on its own. XFA covers the laptop side. It checks each device at sign-in against the settings these frameworks ask about, and people fix what needs fixing from the XFA app. Your policies, vendors, and the rest of the framework stay with you and your auditor.
XFA and complianceOnly if your rules allow it. You set each check to warn or block, after the number of days you choose. A laptop with a warning can still sign in. Once a check blocks, "Sign in anyway" disappears until the setting is right.
Built-in Passkey is phishing-resistant MFA at your identity provider. The XFA app answers it in the background with nothing to type, and the device is checked in the same moment. Your assessor confirms how it fits your setup.
Yes. A contractor's own laptop gets the same check at sign-in as a company laptop. XFA checks security settings and does not collect files, messages, or browsing. It takes no control of the laptop.
BYOD and freelanceXFA is priced per user. The pricing page shows what costs extra.
See pricingStart with the laptops that reach your back office. After that, every sign-in checks them again, so your answer to the auditor stays current.
