An endpoint management checklist holds 15 checks in five groups: inventory and enrollment, policy and encryption, patch status, lost devices and remote wipe, and offboarding. Each check is pass or fail, with evidence to keep. It scores 2, 1 or 0, for a maximum of 30.
Last reviewed 2026-11-03 by Manish Sharma.
MDM stands for mobile device management: central management of a firm’s mobile devices. When you want the full definition, read our glossary entry for MDM. This list belongs to our use case on managing enterprise devices. It gives checks only, and leaves out how to build each control, why gaps hurt and what to buy.
Which Checks Make an Endpoint Management Checklist Audit-Ready?
This list judges audit-readiness with fifteen checks, three in each of five groups that follow a device from arrival to exit. The same checks apply to laptops as well as phones.
- Inventory and enrollment: group 1, checks 1 to 3.
- Policy and encryption: group 2, checks 4 to 6.
- Patch status: group 3, checks 7 to 9.
- Lost devices and remote wipe: group 4, checks 10 to 12.
- Offboarding: group 5, checks 13 to 15.
Each group gets its own table. The columns give the check, the test that counts as a pass, and the evidence to keep. Also, every table runs in the order a device travels.
How Does Scoring Work, and What Does Audit-Ready Mean?
Mark each check Met (2), Partly met (1) or Not met (0).
- Evidence rule: a check with no evidence in the folder does not score Met, whatever the team believes.
- Sample rule: draw five devices from the inventory export. Someone other than the check’s owner makes the draw.
- Test checks: some checks use a spare device. For example, check 11 passes only when a lock command reaches the spare and the console shows it.
- Not applicable: a check that has nothing to test leaves the scale. If nobody left in the review period, check 13 drops out, and the top score becomes 28.
The fleet is audit-ready when a stranger can repeat every pass test from the evidence folder alone.
The list sets no pass mark. Instead, read the five group subtotals first, each with a maximum of 6. A group at 0 or 1 is the finding, whatever the total says.
These pass tests and the sample rule are Signisys’ own method, not taken from a standard. If your auditor sets a different sample, use theirs.
Group 1: Is Every Device Counted and Enrolled?
This group passes when the inventory matches reality and each new device enrolls before it reaches a user. If you want the cost side of a gap here, read why unmanaged devices cost IT time.
| Check | Pass when | Evidence to keep |
|---|---|---|
| 1. One inventory holds every device, with owner, model, OS and ownership type. | Yes if five devices picked from desks or purchase records all appear, with every field filled in. | A dated export of the inventory, with the five picked devices marked. |
| 2. IT finds unmanaged devices, then enrolls them or places them on an approved exception list. | Yes if each device found outside management has an enrollment date or a listed exception with a named approver. | The exception list, with approver name and date on every line. A contractor’s own laptop is one example. |
| 3. Each new device enrolls before it reaches the user. | Yes if the enrollment date falls before the hand-over date for each of the five newest devices. | Enrollment dates from the console, placed beside hand-over dates from the issue log. |
Endpoint Management Checklist Group 2: Are Policies and Encryption Enforced?
This group passes when the rules are written down and flag a drifting device. The endpoint management checklist leaves passwords and sign-in rules out, while check 6 covers encryption and recovery keys.
| Check | Pass when | Evidence to keep |
|---|---|---|
| 4. A written baseline exists per device group, with a named owner. | Yes if each device group in the sample has a baseline with an owner and a review date. | The baseline documents, showing owner names and the last review date. |
| 5. A compliance rule flags a device that drifts. | Yes if a test device that you change on purpose shows as non-compliant in the console. | A screenshot of the flag with its time, the setting you changed, and the time the device returned to compliant. |
| 6. Encryption is on, and recovery keys are retrievable. | Yes if the report shows encryption on for five sampled devices and an administrator retrieves one recovery key. | The encryption report, plus a note of who retrieved the key and when. |
Endpoint Management Checklist Group 3: Can You Prove Patch Status?
This group passes when a report, not a memory, shows which devices are current and what happens to the rest. When this endpoint management checklist says patch status, it means the version a device runs compared with the minimum you set.
| Check | Pass when | Evidence to keep |
|---|---|---|
| 7. A minimum OS version is set and reported against. | Yes if a written minimum exists for each device group and a report shows each sampled device against it. | The minimum-version rule and the report, both dated. |
| 8. Each device behind on updates has an owner and a next action. | Yes if every device on the behind list carries a named owner and a next action with a date. | The behind list, exported on the test day, with owner and next-action columns. |
| 9. Devices that stop checking in are listed and reviewed. | Yes if a list of silent devices exists and a named person reviewed it within the period you set. | The list, with the reviewer’s name and the review date. |
Key Takeaway A report, not a memory, shows which devices are current and what happens to the rest.
Group 4: What Happens When a Device Is Lost?
Three checks cover a lost device: whether the report reaches IT with a time, whether the lock works and whether the wipe works.
Run the lock and wipe tests on spare or test devices only, because a wipe erases the data on the device. Confirm the spare holds no work data before you send a wipe.
| Check | Pass when | Evidence to keep |
|---|---|---|
| 10. A lost-device report reaches IT with a time stamp. | Yes if the last lost-device ticket, or a test report, shows the report time and the time IT received it. | The ticket or test report, with both times visible. |
| 11. Remote lock works on a test device. | Yes if a lock command from the console locks a spare device and the console confirms the lock. | The time of the command, the time the lock appeared on the device and the name of the sender. |
| 12. Remote wipe works on a test device, and a named person approves wipes. | Yes if a wipe command resets a test device and a named person approved it before it ran. | The approval message, the command time, and a photo or log of the reset device. |
Also, keep the wipe record in the same folder as the approval.
Endpoint Management Checklist Group 5: Does Offboarding Close Out Each Device?
This last group passes when every leaver’s device comes back, is wiped, leaves management and closes in the inventory. Disposal then leaves a record. The endpoint management checklist closes with the end of the device lifecycle, and the guide NIST SP 800-124 Rev. 2 covers disposal as well as deployment and use, according to its May 2023 abstract.
| Check | Pass when | Evidence to keep |
|---|---|---|
| 13. A leaver triggers device recovery, matched against the HR list. | Yes if each name on the HR leaver list has a recovered device or a written reason the device is missing. | The HR leaver list beside the device returns, with dates. |
| 14. A returned device is wiped, removed from management and closed in the inventory. | Yes if each returned device in the sample shows a wipe, a console removal and a closed inventory record. | The wipe confirmation, the console removal date and the inventory status for each device. |
| 15. Disposal or reissue leaves a record. | Yes if each device that left the firm, or went to a new user, has a dated record. | A disposal note or reissue entry with the date and the receiving person or party. |
In What Order Should You Close the Not Met Marks?
Close Not met marks in group 1 before any other group, then Not met before Partly met.
This order is Signisys’ own rule. The sample for checks 4, 6, 7 and 14 comes from the inventory export, so a gap in group 1 weakens those four tests. For example, a patch fix made first (check 7) needs a second test once group 1 changes the inventory.
When group 1 has no Not met marks left, work through the rest in check order. Then turn to the Partly met marks, again in check order. When a mark changes, test again with a fresh draw of five devices, not the same five.
Leave the old mark in place when you write the date and the new mark beside it in the evidence folder. Both marks together give an auditor the history of each check.
Key Takeaway Close Not met marks in group 1 first, then the rest in check order.
Where This Endpoint Management Checklist Stops
This list checks a fleet, but it does not build one or defend one. A top total shows only that the sampled devices passed on the day of the test. It says nothing about devices outside the sample.
- Building: the build order for each control is a separate guide.
- Attacks: how an attack reaches a device is a threat topic, and this list has no check for it.
- Product choice: the list names no product.
- Law: it is not legal advice.
While the NCSC device security guidance is UK guidance on choosing, configuring and using devices securely (reviewed 13 May 2025), for a firm in India or the GCC it is a reference, not a local rule.
Signisys provides device management services, and this list points to them. See our endpoint management solution and device lifecycle support.
Endpoint Management Checklist FAQ: Questions Answered
What should an endpoint management checklist include?
What if a device will not enroll at all?
What counts as evidence for a lost-device test?
Which checks need a test device?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.