In short
Endpoint security best practices are: keep an inventory of every device, harden builds, patch on a schedule, remove local admin rights, control USB and applications, encrypt disks, run EDR with someone watching alerts, protect phones and tablets, keep restorable backups, and test your response. Each maps to NCSC Device Security Guidance and the Cyber Essentials controls.
Get a quote for an endpoint security review
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Why best practice comes before more products
It is tempting to answer every new threat with another tool. In practice, most endpoint incidents exploit something basic: a missed update, a user with admin rights, a device nobody knew about, or an alert nobody read. The practices below close those gaps, and they make whatever security products you run far more effective.
They are drawn from the NCSC's Device Security Guidance and line up with the five Cyber Essentials controls. They apply to Windows, macOS and Linux computers, servers, and phones and tablets, with the detail varying by platform.
The ten endpoint security best practices
1. Keep an inventory of every device List every laptop, desktop, server, virtual machine, phone and tablet that reaches your data, including personal devices. Record the owner, operating system, version and whether it is enrolled in management and protected. Reconcile the list against your security console and sign-in logs regularly; every device that appears in one and not the other needs explaining. See what is an endpoint in cyber security.
2. Harden builds from a known baseline Start every device from a secure configuration: unused software and services removed, auto-run disabled, macros restricted, the host firewall on, secure boot enabled and default passwords changed. Use the NCSC platform guides or CIS Benchmarks as your baseline and enforce it centrally. Our endpoint hardening checklist goes through it area by area.
3. Patch on a schedule, and check it worked Turn on automatic updates where you can, and run a defined cycle for everything else: assess, prioritise, test, deploy in rings and verify. Include browsers, office apps and third-party software, not only the operating system, and replace software that is no longer supported. See the patch management process.
4. Remove standing local admin rights Day-to-day accounts should not be administrators. When people need to install or change something, grant elevation for that task only, with approval or justification and an audit trail. See endpoint privilege management.
5. Control USB devices and applications Decide which removable media and peripherals are allowed, read-only or blocked, and audit what is connected. Move towards allowing only approved applications to run, starting in audit mode. See USB device control and application whitelisting.
6. Encrypt every laptop and removable drive Full disk encryption means a lost or stolen device is an inconvenience rather than a data breach. Enforce it by policy, escrow recovery keys centrally and report on encryption status. See full disk encryption and BitLocker management.
7. Run EDR, with someone watching the alerts Prevention will not stop everything. Endpoint detection and response records what happens on each device so an attack can be spotted and contained. Agree who triages alerts, what automatic responses are allowed and what happens out of hours; a vendor-run managed detection and response service is one answer. Turn on tamper protection so the agent cannot simply be switched off.
8. Protect phones and tablets Enrol company phones in device management, set a passcode and keep the operating system current. For phones that reach email and business apps, including personal ones, add mobile threat defence to catch smishing, malicious apps and risky networks, and follow a written BYOD security policy.
9. Back up, and keep a copy attackers cannot reach Keep backups of servers, important endpoint data and cloud services, with at least one copy offline or immutable and separate from your normal admin accounts. Test restores. Forever Group's cloud backup service is one option.
10. Write down and test your response Decide in advance who does what when a device is compromised: isolate, investigate, reset credentials, restore and report. Run a short tabletop exercise at least once a year and update the plan afterwards. Our guide on how to prevent ransomware attacks covers the ransomware-specific steps.
Endpoint security controls checklist
Use this table as a quick checklist. It maps each practice to the relevant part of the NCSC Device Security Guidance and to the Cyber Essentials control it supports.
| Practice | NCSC Device Security Guidance | Cyber Essentials control | Guide |
|---|---|---|---|
| Inventory every device | Getting ready; Managing deployed devices | Scope (every in-scope device) | What is an endpoint |
| Harden builds | Platform guides and recommended configurations | Secure configuration | Endpoint hardening |
| Patch on a schedule | Keeping devices and software up to date; Obsolete products | Security update management | Patch management |
| Remove local admin | Platform guides (non-administrative accounts) | User access control | Endpoint privilege management |
| Control USB and apps | Using peripherals securely; Using third-party applications | Malware protection | USB device control, application whitelisting |
| Encrypt disks | Platform guides (full disk encryption) | Not a Cyber Essentials control; supports UK GDPR security | Full disk encryption |
| EDR with alert triage | Antivirus and other security software; Logging and protective monitoring | Malware protection | EDR |
| Protect phones | Mobile Device Management; Bring your own device | Controls apply to in-scope phones (BYOD) | Mobile threat defence |
| Restorable backups | Not covered directly | Not a Cyber Essentials control | Prevent ransomware attacks |
| Tested response plan | Logging and protective monitoring | Not a Cyber Essentials control | Endpoint security policy |
Cyber Essentials sets specific rules, for example that critical and high-risk updates are installed within 14 days and that anti-malware or application allow listing is active on every in-scope device. The full detail lives on our sister site's Cyber Essentials requirements pages.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Turn the checklist into policy
A checklist helps you get started; a policy keeps it going. Write the practices above into a short endpoint security policy that says what the minimum is for each type of device, who owns each control, and how exceptions are approved. Then configure the same rules as technical policies in your security and device management consoles, so the written policy and the real settings match.
Review the policy when something changes: a new operating system, a merger, a move to new cloud services, or an incident. Console reports on patch levels, encryption, agent health and blocked devices make that review quick and give you evidence for Cyber Essentials, customers and insurers. Our endpoint security compliance guide shows how those reports map to UK frameworks.
Common endpoint security gaps to look for
When an organisation reviews its endpoints properly for the first time, these are the kinds of issue worth checking for:
- Devices in the asset list with no security agent, or agents that have stopped reporting
- Two security products fighting each other, or one left in a passive mode nobody intended
- Staff accounts that are local administrators because it was easier at setup
- Third-party apps and browsers lagging well behind operating system patches
- EDR alerts going to a shared mailbox that nobody owns
- Recovery keys for encrypted laptops stored nowhere central
- Phones with work email and no management at all
None of these needs a big project to fix, but each one is a real way in for an attacker.
Is an endpoint security review the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How we help
We can review your endpoints against this checklist, show you where the gaps are, and recommend the smallest set of changes and products that closes them. Because we supply several platforms, from endpoint detection and response to mobile threat defence and encryption, the recommendation is based on fit, not on one vendor's range. We can then help plan the changes and the licensing, with pricing confirmed at quote.
Contact us to arrange an endpoint security review.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What are endpoint security best practices?
The core practices are an up-to-date device inventory, hardened builds, regular patching, no standing local admin rights, control of USB devices and applications, disk encryption, EDR with someone acting on alerts, protection for phones and tablets, restorable backups and a tested response plan.
What should an endpoint security checklist include?
At minimum: every device listed and enrolled, a secure configuration baseline, patch status, admin rights, removable media rules, application control, encryption status with recovery keys escrowed, EDR coverage and alert ownership, mobile protection, backups and an incident response plan. The table on this page maps each item to NCSC guidance and Cyber Essentials.
How often should endpoints be patched?
Turn on automatic updates wherever possible and run a regular cycle for everything else. Cyber Essentials requires critical and high-risk security updates to be installed within 14 days of release, so your process needs to meet that as a minimum for in-scope devices.
Do we still need antivirus if we have EDR?
Most business EDR platforms include next-generation antivirus in the same agent, so you get both. What you should avoid is running two full antivirus or EDR products on one device, which can cause conflicts. Check that prevention is switched on in whichever platform you run.
Do these best practices apply to Macs and phones?
Yes. The principles are the same, though the tools differ. Macs need encryption, Gatekeeper enforcement, updates and an EDR agent; phones need device or app management, a passcode, current updates and, where they reach business data, mobile threat defence.
Still have a question about an endpoint security review?
Ask us and a member of our team will reply by email.