> ## Documentation Index > Fetch the complete documentation index at: https://syteca.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Syteca ESPM baseline policy > Assess endpoint security posture through a baseline set of security, data protection, network, account management, and monitoring controls designed to identify common operational and cybersecurity risks. ## Overview The Syteace ESPM baseline policy provides a comprehensive assessment of endpoint security posture by evaluating a broad set of technical controls and risk indicators across managed devices. It serves as a foundational security policy designed to identify the most common and impactful risks affecting endpoint security, operational resilience, and data protection. The policy aligns with security principles and recommendations found across major frameworks and standards, including ISO 27001, NIST Cybersecurity Framework, CIS Controls, PCI DSS, and other cybersecurity best practices. It provides continuous visibility into security weaknesses that could increase the likelihood of compromise, data loss, unauthorized access, or operational disruption. ## Controls ### Account Management Account Management governs the lifecycle and security of user and service accounts. Weak account controls can lead to unauthorized access, privilege abuse, identity compromise, and increased attack surface. This control focuses on ensuring that authentication mechanisms, account configurations, and privilege assignments follow security best practices and support secure access management. ### Behavioral & Performance Monitoring Behavioral & Performance Monitoring identifies signs of suspicious activity, abnormal system behavior, and excessive resource consumption that may indicate security threats, malware activity, operational issues, or compromised devices. This control supports early threat detection and helps maintain system performance, availability, and stability. ### Data Protection & Recovery Data Protection & Recovery safeguards sensitive information and supports business continuity. Strong encryption, backup capabilities, and recovery mechanisms help reduce the impact of ransomware, accidental data loss, hardware failure, and other disruptive events. This control focuses on maintaining data confidentiality, recoverability, and resilience throughout the endpoint lifecycle. ### Network Security Network Security protects communications, restricts unauthorized access, and reduces opportunities for attackers to gain entry into systems or move laterally throughout the environment. This control validates security mechanisms designed to secure network traffic, regulate connectivity, and protect endpoints from external threats. ### System Security System Security ensures the integrity and resilience of the operating system and its core security components. Misconfigured or disabled operating system protections may create opportunities for malware execution, privilege escalation, unauthorized access, and persistence by attackers. This control helps verify that critical operating system security features remain enabled, properly configured, and capable of protecting the endpoint against common attack techniques. ## Risk Factors The ESPM Baseline Policy evaluates a broad collection of technical risk indicators. ### Endpoint Protection Assesses endpoint security technologies designed to prevent, detect, and respond to malicious activity. **Examples:** * Antivirus and real-time protection status * Microsoft Defender SmartScreen configuration * Potentially unwanted application (PUA) protection * Driver and application reputation controls * Windows security hardening features ### Operating System Security Evaluates operating system security settings and built-in protections that help defend against unauthorized access, malware, and privilege escalation. **Examples:** * Secure Boot status * User Account Control (UAC) * Local Security Authority (LSA) protection * Memory Integrity and Core Isolation * Kernel protection features * Windows Sandbox configuration ### Encryption & Data Protection Assesses controls that help protect sensitive information from unauthorized access and support recovery capabilities. **Examples:** * BitLocker encryption status * System disk encryption * Fixed drive encryption * OneDrive folder backup protection * Recovery readiness ### Account & Authentication Security Evaluates authentication methods, local account security, privilege management, and user account hygiene. **Examples:** * Dormant accounts * Password aging and expiration settings * Guest account configuration * Local administrator account configuration * Windows Hello authentication settings * Multifactor authentication enforcement ### Network & Remote Access Security Assesses controls that regulate network connectivity and protect endpoints from unauthorized access. **Examples:** * Firewall protection * Remote Desktop Protocol (RDP) exposure * Guest authentication settings * Network security configurations * Access restriction mechanisms ### Application & Browser Security Evaluates software execution controls and browser-related risks that may introduce security vulnerabilities. **Examples:** * Browser extension risks * Native messaging integrations * Application installation restrictions * Unsigned or untrusted software * PowerShell security posture ### Vulnerability & Patch Management Assesses endpoint maintenance and update practices used to reduce exposure to known vulnerabilities. **Examples:** * Missing operating system updates * Windows Update configuration ### Behavioral Monitoring & Threat Detection Identifies activities and system behaviors commonly associated with security incidents, misuse, or compromise. **Examples:** * Suspicious authentication activity * Privilege escalation events * Security policy modifications * Untrusted process execution * Processes launched from temporary directories * Security-related event log indicators ### Performance & Operational Health Evaluates endpoint resource utilization and operational indicators that may affect system performance or suggest misuse. **Examples:** * High CPU utilization * Excessive memory consumption * Disk utilization anomalies * Storage-related errors * System time manipulation ### User Session Security Assesses controls that protect unattended devices and reduce the risk of unauthorized local access. **Examples:** * Screen saver configuration * Session lock settings * Password-on-wake requirements * Inactivity timeout configuration ## Important Notes * The ESPM Baseline Policy represents a broad security baseline and is intended to provide continuous visibility into common endpoint security risks. * The policy consolidates technical controls that are broadly applicable across multiple security frameworks and regulatory standards. * AI-related monitoring and endpoint geolocation checks are intentionally excluded and are covered by dedicated policies (see [Syteca AI usage policy](/docs/espm/policies/ai-usage-policy) and [Syteca Endpoint Geolocation policy](/docs/espm/policies/endpoint-geolocation)). * Individual risk factors may support multiple controls and may contribute to overall risk scoring in different ways. ## Business Value The ESPM Baseline Policy provides organizations with a single, comprehensive view of endpoint security health across their environment. By continuously evaluating system security, data protection, account management, network security, operational health, and threat indicators, the policy helps identify risks early, prioritize remediation efforts, improve compliance readiness, and strengthen overall cyber resilience. ## Related Review policy compliance across your environment, identify non-compliant endpoints and risk factors. Explore security and compliance policies, understand how risk factors, controls, and severity ratings contribute to policy health scores.