Protect · Foundational tier · Endpoint Security

PR-08Endpoint protection runs on every host

Every host runs a healthy endpoint sensor with the bank's prevention policy applied.

Status

Partial evidence

1 item only partly supports it.

Exposure

Critical

1 evidence items from 1 sources

CCSA · Protect

Below Foundational

This control blocks Foundational for the whole domain.

What the evidence shows

736 branch hosts run in detection-only mode; prevention covers 94.1% of reporting hosts.

Remediation · Endpoint Security

Apply the Bank-Standard prevention policy in the branch imaging process and fence off unmanaged hosts from core banking.

Root cause: Branch workstation refresh. 740 hosts were imaged without CMDB registration or a healthy sensor.

Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.

ev-pr08-1

Prevention policy applied on 94.1% of reporting hosts

CrowdStrike Falcon · telemetry · collected 1 h ago (Oct 15, 2026 · 12:59 UTC) · limit 48 h

Partial