Pillar 2: Device
Establish and maintain trust in every device (managed, unmanaged, IoT, OT) before and during its access to enterprise resources.
Key principles
- Every device has a real-time trust score, not a one-time approval.
- Compliance and health posture are continuously verified, not checked only at enrollment.
- Unmanaged and IoT/OT devices are inventoried and constrained even if they can’t run an agent.
Maturity snapshot
| Stage | Characteristics |
|---|---|
| Traditional | Manual asset inventory, periodic compliance audits |
| Advanced | MDM/EDR-driven inventory and compliance scoring, posture checks gate access |
| Optimal | Hardware-rooted attestation, continuous real-time device trust scoring |
Related capabilities
See Device Inventory & Compliance and Device Health Attestation in the capability matrix.
Framework tie-ins
NIST 800-53 (CM family), NIST 800-207 §3.3, PCI-DSS v4.0 (Req. 12.5).
Capabilities in this pillar
Firmware & Supply Chain Integrity
No firmware or hardware supply-chain attestation
Periodic firmware/BIOS integrity checks
Continuous hardware-rooted supply-chain attestation at every boot/session
Device Health Attestation
No attestation; trust based on network location
Agent-based posture checks (patch level, disk encryption) gate access
Hardware-rooted attestation (TPM) continuously verified per session
Device Inventory & Compliance
Manual asset spreadsheets, periodic audits
Automated MDM/EDR-based inventory with compliance scoring
Real-time device trust scoring feeding dynamic access decisions
Third-Party & Vendor Device Risk
No visibility into vendor/contractor device posture
Vendor devices required to enroll in MDM or pass a posture check before access
Continuous vendor device risk scoring integrated into access decisions