Comply with Confidence: Endpoint Central for NIST SP 800-171

03.01 Access Control

3.1.1, 3.1.2, 3.1.5, 3.1.7

Limit system access to authorized users, processes and devices. Enforce least privilege and prevent non-privileged users from running privileged functions.

Scope local users into role-based groups with user management, gate every device with conditional access, and strip standing admin rights through privilege management with Just-in-Time elevation.

3.1.8, 3.1.9, 3.1.10

Limit failed logon attempts, display CUI privacy notices, and lock sessions after inactivity.

Push account lockout policies, Legal Notice banners, and power management session-lock rules to every endpoint from one console.

3.1.12, 3.1.13, 3.1.15

Monitor remote access, encrypt remote sessions, and authorize remote execution of privileged commands.

Endpoint Central's Remote Control runs over HTTPS with 256-bit AES (and can operate in FIPS 140-2 mode); firewall configuration blocks unsanctioned outbound channels.

3.1.18 to 3.1.22

Control mobile devices, encrypt CUI on mobile, restrict portable storage and external systems, and govern CUI on public-facing endpoints.

SCEP-based MDM enrollment, BitLocker/FileVault/MDM encryption, Device Control Plus USB policies, and browser security URL filtering shut down every common CUI exfil path.

03.03 Audit and Accountability

3.3.1, 3.3.2, 3.3.3

Create, retain and review system audit logs; uniquely trace user actions; and review logged events.

Centralize every endpoint's Event Viewer with category-based filters, track user logon and console activity through built-in reports, and stream to EventLog Analyzer, Splunk, or Rapid7 for long-term review.

03.04 Configuration Management

3.4.1, 3.4.2, 3.4.3, 3.4.4

Establish baseline configurations and inventories, enforce hardened settings, track changes, and assess impact before deployment.

IT asset management maintains live inventories, security configuration management enforces hardened baselines, and Test and Approve validates patches on a pilot group before broad rollout.

3.4.6, 3.4.7, 3.4.8, 3.4.9

Enforce least functionality, restrict nonessential ports and services, allowlist authorized software, and monitor user-installed apps.

Application Control Plus handles enterprise-wide allowlisting and blocklisting, firewall configuration kills unused ports, and the Self-Service Portal keeps approved software shipping without shadow IT.

03.05 Identification and Authentication

3.5.1, 3.5.2, 3.5.3, 3.5.7

Uniquely identify users, processes and devices; authenticate before access; require MFA for privileged accounts; enforce password complexity.

System Manager surfaces every user, process, and device identifier; two-factor authentication protects console access; and password policy deployment enforces complexity across endpoints.

03.07 Maintenance

3.7.1, 3.7.4, 3.7.5, 3.7.6

Perform system maintenance, scan diagnostic media for malware, require MFA for non-local maintenance, and supervise unauthorized personnel.

Next-gen antivirus scans new media on insert, MFA gates console-led remote maintenance, and Remote Control's view-only mode supervises every unescorted session.

03.08 Media Protection

3.8.1, 3.8.2, 3.8.3, 3.8.5, 3.8.7

Protect CUI on physical and digital media, limit access, sanitize before disposal, control transport, and lock down removable media.

Device Control Plus enforces USB policies with file tracing and shadowing; file/folder operations sanitize CUI; remote wipe handles end-of-life devices.

3.8.9

Protect the confidentiality of CUI backups at storage locations.

BitLocker Management for Windows and FileVault for macOS encrypt every disk that stores backup CUI.

03.09 Personnel Security

3.9.2

Protect organizational systems containing CUI during and after personnel terminations and transfers.

Trigger remote wipe, back up CUI to a secure repository, and revoke console access through role-based administration the moment HR flags a separation.

03.11 Risk Assessment

3.11.1, 3.11.2, 3.11.3

Assess organizational risk continuously, scan for vulnerabilities, and remediate per the risk ranking.

Vulnerability Manager runs continuous CVSS-prioritized scans and pushes one-click remediation through automated patch and configuration deployment.

03.12 Security Assessment and Monitoring

3.12.1, 3.12.2, 3.12.3

Assess control effectiveness, build plans of action for deficiencies, and monitor controls continuously.

TheDPO Dashboard and module-level reports give you real-time evidence of BitLocker, patch, firewall, and DLP posture, ready to hand to an assessor.

03.13 System and Communications Protection

3.13.1, 3.13.4, 3.13.8, 3.13.11, 3.13.16

Protect boundary communications, prevent unintended information transfer, use FIPS-validated cryptography, and protect CUI at rest.

Firewall configuration plus port audits shut down exposed channels; FIPS 140-2 mode plus BitLocker, FileVault, and MDM encryption keep CUI encrypted everywhere it lives.

03.14 System and Information Integrity

3.14.1, 3.14.2, 3.14.3, 3.14.4

Identify and correct flaws, protect against malicious code, monitor security alerts, and keep protection mechanisms current.

Continuous patching and next-gen antivirus with AI-assisted behavior analytics, tamper protection, and auto-updating engines close the malware and flaw gaps in one stack.

3.14.6, 3.14.7

Monitor traffic for attack indicators and identify unauthorized system use.

Anti-ransomware behavioral detection plus USB audit and unapproved-software reports surface unauthorized activity instantly; isolate or quarantine endpoints from the same console.

03.15 Planning (new in Rev 3)

3.15.1, 3.15.2

Develop and maintain a System Security Plan and rules of behavior for handling CUI.

Live inventories, configuration baselines, role assignments, and compliance reports feed your SSP directly; Legal Notice banners and MDM content distribution operationalize your rules of behavior.

03.16 System and Services Acquisition (new in Rev 3)

3.16.1, 3.16.2

Apply acquisition controls to systems and services; hold external providers to your security requirements.

Software inventory, license management, and prohibited-software policies govern what enters the environment; role-based admin and console audit trails keep MSP partners accountable.

03.17 Supply Chain Risk Management (new in Rev 3)

3.17.1, 3.17.2, 3.17.3

Build a supply chain risk plan, assess critical suppliers, and use procurement to mitigate supply chain risk.

Hardware and software inventories give you a continuous bill-of-materials view; end-of-life software audits flag risky vendors; application allowlisting blocks unsanctioned tools at the door.