Sophos Endpoint Protection Compliance
46 atomic requirements assessed
46 atomic requirements assessed
AI Atomic Compliance Determination
Multi-model AI assessment of how Sophos Endpoint Protection satisfies individual compliance requirements — evaluated atom-by-atom across each framework.
5-Model AI Ensemble — AI Proposed
Each requirement was evaluated independently by 5 AI models (GPT-4o-mini, Llama 3.3, DeepSeek V3, Qwen 72B, Gemini Flash). Results represent AI consensus — not a formal audit or legal compliance opinion. Confidence scores are capped by evidence tier; all results are AI-proposed pending human review.
CIS IG3 All Controls
46 requirements evaluated
✓ 22 Meets
~ 17 Partial
✗ 7 Does Not Meet
| Determination | Type | Req. ID | Statement | Conf. |
|---|---|---|---|---|
| Meets | hybrid | 8.9.a | Centralize, to the extent possible, audit log collection and retention across enterprise assets in accordance with the documented audit log management process. | 79% |
| Does Not Meet | technical | 8.9.b | Example implementations primarily include leveraging a SIEM tool to centralize multiple log sources. | 41% |
| Meets | technical | 8.5.f | Include source addresses in the audit logs. | 79% |
| Meets | technical | 8.5.a | Configure detailed audit logging for enterprise assets containing sensitive data. | 79% |
| Meets | technical | 8.5.c | Include date in the audit logs. | 87% |
| Meets | technical | 8.5.g | Include destination addresses in the audit logs. | 79% |
| Meets | technical | 8.5.b | Include event source in the audit logs. | 79% |
| Meets | technical | 8.5.d | Include username in the audit logs. | 87% |
| Meets | technical | 8.5.e | Include timestamp in the audit logs. | 87% |
| Partially Meets | hybrid | 8.5.h | Include other useful elements that could assist in a forensic investigation in the audit logs. | 87% |
| Partially Meets | hybrid | 8.3.a | Ensure that logging destinations maintain adequate storage to comply with the enterpriseΓÇÖs audit log management process. | 76% |
| Meets | technical | 8.2.a | Collect audit logs. | 87% |
| Meets | technical | 8.2.b | Ensure that logging has been enabled across enterprise assets. | 79% |
| Meets | technical | 8.1.a | Retain audit logs across enterprise assets for a minimum of 90 days. | 79% |
| Meets | hybrid | 6.8.a | Define and maintain role-based access control. | 81% |
| Partially Meets | process | 6.8.b | Determine and document the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. | 74% |
| Meets | hybrid | 6.7.a | Centralize access control for all enterprise assets through a directory service or SSO provider, where supported. | 85% |
| Meets | technical | 6.5.a | Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a service provider. | 79% |
| Meets | technical | 6.4.a | Require MFA for remote network access. | 85% |
| Meets | technical | 6.3.b | Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard | 77% |
| Meets | technical | 6.3.a | Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. | 82% |
| Partially Meets | technical | 6.2.c | Disable accounts immediately upon rights revocation of a user. | 74% |
| Partially Meets | technical | 6.2.d | Disable accounts immediately upon role change of a user. | 71% |
| Partially Meets | hybrid | 6.2.a | Establish and follow a process, preferably automated, for revoking access to enterprise assets. | 80% |
| Partially Meets | hybrid | 6.2.b | Disable accounts immediately upon termination of a user. | 73% |
| Partially Meets | hybrid | 6.1.c | The documented process for granting access to enterprise assets upon new hire or role change of a user is preferably automated. | 71% |
| Partially Meets | hybrid | 6.1.b | The process for granting access to enterprise assets is preferably automated | 76% |
| Partially Meets | process | 6.1.a | Establish and follow a documented process for granting access to enterprise assets upon new hire or role change of a user. | 71% |
| Meets | technical | 5.6.a | Centralize account management through a directory or identity service. | 87% |
| Does Not Meet | hybrid | 5.5.f | Service account reviews must be performed on a recurring schedule at a minimum quarterly, or more frequently. | 33% |
| Does Not Meet | process | 5.5.d | The inventory must contain purpose. | 33% |
| Does Not Meet | process | 5.5.b | The inventory must contain department owner. | 33% |
| Does Not Meet | hybrid | 5.5.c | The inventory must contain review date. | 33% |
| Partially Meets | hybrid | 5.5.a | Establish and maintain an inventory of service accounts. | 71% |
| Partially Meets | hybrid | 5.5.e | Perform service account reviews to validate that all active accounts are authorized. | 76% |
| Meets | process | 5.4.b | Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the userΓÇÖs primary, non-privileged account. | 79% |
| Partially Meets | hybrid | 5.4.a | Restrict administrator privileges to dedicated administrator accounts on enterprise assets. | 79% |
| Partially Meets | hybrid | 5.3.a | Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported. | 71% |
| Does Not Meet | technical | 5.2.c | Best practice implementation includes, at a minimum, a 14-character password for accounts not using MFA. | 33% |
| Partially Meets | technical | 5.2.b | Best practice implementation includes, at a minimum, an 8-character password for accounts using Multi-Factor Authentication (MFA). | 66% |
| Does Not Meet | hybrid | 5.2.a | Use unique passwords for all enterprise assets. | 26% |
| Meets | hybrid | 5.1.a | Establish and maintain an inventory of all accounts managed in the enterprise. | 87% |
| Meets | hybrid | 5.1.c | The inventory, at a minimum, should contain the personΓÇÖs name, username, start/stop dates, and department. | 79% |
| Meets | hybrid | 5.1.b | The inventory must at a minimum include user, administrator, and service accounts. | 87% |
| Partially Meets | hybrid | 5.1.d | Validate that all active accounts are authorized. | 71% |
| Partially Meets | technical | 13.1.a | Perform Application Layer Filtering | 71% |