Syteca ESPM baseline policy

​

Overview

The Syteace ESPM baseline policy provides a comprehensive assessment of endpoint security posture by evaluating a broad set of technical controls and risk indicators across managed devices. It serves as a foundational security policy designed to identify the most common and impactful risks affecting endpoint security, operational resilience, and data protection. The policy aligns with security principles and recommendations found across major frameworks and standards, including ISO 27001, NIST Cybersecurity Framework, CIS Controls, PCI DSS, and other cybersecurity best practices. It provides continuous visibility into security weaknesses that could increase the likelihood of compromise, data loss, unauthorized access, or operational disruption.

​

Controls

​

Account Management

Account Management governs the lifecycle and security of user and service accounts. Weak account controls can lead to unauthorized access, privilege abuse, identity compromise, and increased attack surface. This control focuses on ensuring that authentication mechanisms, account configurations, and privilege assignments follow security best practices and support secure access management.

​

Behavioral & Performance Monitoring

Behavioral & Performance Monitoring identifies signs of suspicious activity, abnormal system behavior, and excessive resource consumption that may indicate security threats, malware activity, operational issues, or compromised devices. This control supports early threat detection and helps maintain system performance, availability, and stability.

​

Data Protection & Recovery

Data Protection & Recovery safeguards sensitive information and supports business continuity. Strong encryption, backup capabilities, and recovery mechanisms help reduce the impact of ransomware, accidental data loss, hardware failure, and other disruptive events. This control focuses on maintaining data confidentiality, recoverability, and resilience throughout the endpoint lifecycle.

​

Network Security

Network Security protects communications, restricts unauthorized access, and reduces opportunities for attackers to gain entry into systems or move laterally throughout the environment. This control validates security mechanisms designed to secure network traffic, regulate connectivity, and protect endpoints from external threats.

​

System Security

System Security ensures the integrity and resilience of the operating system and its core security components. Misconfigured or disabled operating system protections may create opportunities for malware execution, privilege escalation, unauthorized access, and persistence by attackers. This control helps verify that critical operating system security features remain enabled, properly configured, and capable of protecting the endpoint against common attack techniques.

​

Risk Factors

The ESPM Baseline Policy evaluates a broad collection of technical risk indicators.

​

Endpoint Protection

Assesses endpoint security technologies designed to prevent, detect, and respond to malicious activity. Examples:

• Antivirus and real-time protection status
• Microsoft Defender SmartScreen configuration
• Potentially unwanted application (PUA) protection
• Driver and application reputation controls
• Windows security hardening features

​

Operating System Security

Evaluates operating system security settings and built-in protections that help defend against unauthorized access, malware, and privilege escalation. Examples:

• Secure Boot status
• User Account Control (UAC)
• Local Security Authority (LSA) protection
• Memory Integrity and Core Isolation
• Kernel protection features
• Windows Sandbox configuration

​

Encryption & Data Protection

Assesses controls that help protect sensitive information from unauthorized access and support recovery capabilities. Examples:

• BitLocker encryption status
• System disk encryption
• Fixed drive encryption
• OneDrive folder backup protection
• Recovery readiness

​

Account & Authentication Security

Evaluates authentication methods, local account security, privilege management, and user account hygiene. Examples:

• Dormant accounts
• Password aging and expiration settings
• Guest account configuration
• Local administrator account configuration
• Windows Hello authentication settings
• Multifactor authentication enforcement

​

Network & Remote Access Security

Assesses controls that regulate network connectivity and protect endpoints from unauthorized access. Examples:

• Firewall protection
• Remote Desktop Protocol (RDP) exposure
• Guest authentication settings
• Network security configurations
• Access restriction mechanisms

​

Application & Browser Security

Evaluates software execution controls and browser-related risks that may introduce security vulnerabilities. Examples:

• Browser extension risks
• Native messaging integrations
• Application installation restrictions
• Unsigned or untrusted software
• PowerShell security posture

​

Vulnerability & Patch Management

Assesses endpoint maintenance and update practices used to reduce exposure to known vulnerabilities. Examples:

• Missing operating system updates
• Windows Update configuration

​

Behavioral Monitoring & Threat Detection

Identifies activities and system behaviors commonly associated with security incidents, misuse, or compromise. Examples:

• Suspicious authentication activity
• Privilege escalation events
• Security policy modifications
• Untrusted process execution
• Processes launched from temporary directories
• Security-related event log indicators

​

Performance & Operational Health

Evaluates endpoint resource utilization and operational indicators that may affect system performance or suggest misuse. Examples:

• High CPU utilization
• Excessive memory consumption
• Disk utilization anomalies
• Storage-related errors
• System time manipulation

​

User Session Security

Assesses controls that protect unattended devices and reduce the risk of unauthorized local access. Examples:

• Screen saver configuration
• Session lock settings
• Password-on-wake requirements
• Inactivity timeout configuration

​

Important Notes

• The ESPM Baseline Policy represents a broad security baseline and is intended to provide continuous visibility into common endpoint security risks.
• The policy consolidates technical controls that are broadly applicable across multiple security frameworks and regulatory standards.
• AI-related monitoring and endpoint geolocation checks are intentionally excluded and are covered by dedicated policies (see Syteca AI usage policy and Syteca Endpoint Geolocation policy).
• Individual risk factors may support multiple controls and may contribute to overall risk scoring in different ways.

​

Business Value

The ESPM Baseline Policy provides organizations with a single, comprehensive view of endpoint security health across their environment. By continuously evaluating system security, data protection, account management, network security, operational health, and threat indicators, the policy helps identify risks early, prioritize remediation efforts, improve compliance readiness, and strengthen overall cyber resilience.

​

Related