device status

software inventory

antivirus status

overall security and compliance posture

Removes the device from management

Performs best-effort cleanup of Secureframe-applied configurations

Performs a best-effort device lockout or destructive action for lost or stolen devices

Removes the device from management

Wipe behavior varies by operating system, using native system capabilities to:

Enforces strong password policies across supported platforms, including minimum length, complexity, and account lockout protections.

On Windows, a full set of password controls is enforced, including expiration, history, and lockout policies.

On macOS and Linux, password complexity is enforced, while some advanced controls (such as password history and certain reset requirements) depend on operating system capabilities and may not be fully enforceable.

Detects and disables automatic login to ensure users must authenticate before accessing the device.

Enforces automatic screen locking after a period of inactivity and requires authentication to regain access.

Ensures that the device firewall is enabled and properly configured using the operating system's native firewall capabilities.

Validates that disk encryption is enabled to protect data at rest.

On supported platforms, Secureframe can assist with enabling encryption where possible.

In some cases, encryption may require user interaction or device setup changes and cannot be fully enforced remotely.

Validates the presence and status of endpoint protection.

On Windows, built-in protections are leveraged to ensure real-time protection, threat detection, and up-to-date signatures.

On macOS and Linux, protection depends on native system capabilities or existing security tools. Secureframe also evaluates integrated device data to confirm whether active protection is present.

Enforces a pre-login warning banner to inform users about authorized use and monitoring requirements.

Detects and restricts remote administrative access pathways to reduce unauthorized access risk.

Supports controls to reduce the risk of data exfiltration via removable media.

On Windows, both access restrictions and anti-malware scanning for removable media are supported.

On macOS and Linux, enforcement of removable media restrictions is limited due to operating system capabilities.

Validates and enforces application execution controls using native platform capabilities. Some advanced protections may be monitored but not fully enforceable, depending on the operating system.

Ensures that system audit logging is enabled and configured to capture security-relevant activity.

Where supported, logging configuration is enforced; in other cases, Secureframe validates that logging is active and sufficient for monitoring and compliance purposes.

Provides visibility into installed software and system update status.

Compliance signals are derived from device and system data, including whether critical updates are missing and what software is installed on each device.

Supports operational actions and additional detection capabilities:

Cleanup: removes Secureframe-applied configurations during device offboarding

Wipe: performs best-effort device lockout or data destruction for lost or stolen devices

Supplemental detection: identifies security-relevant activity and limited device context to support monitoring and investigations

Uses native event logging with near real-time monitoring of selected security events

Use periodic monitoring of system activity to identify relevant events

privileged commands

authentication events

security or configuration changes

device and system information

integrated data such as antivirus status, software inventory, update status, and device metadata

Enforced controls: validated, remediated where possible, and re-verified

Monitored controls: evaluated based on available system and device information

Supports near real-time security event monitoring

Provides the broadest enforcement coverage across controls

Some controls may be monitoring-only (e.g., disk encryption is validated but not automatically enabled)

Supports enforcement for key controls such as screen lock, firewall, password complexity, and automatic login disablement

Some controls are partially enforceable due to operating system limitations (e.g., certain protections cannot be enabled remotely, disk encryption may require user interaction)

Supports enforcement for selected controls such as screen lock, firewall, password complexity, audit logging, and application control

Some controls require manual remediation or external tooling (e.g., full disk encryption, antivirus)

Compliance is evaluated consistently across platforms, even though implementation differs

Each operating system relies on its native capabilities for enforcement and monitoring

Control behavior may vary depending on OS limitations and available features

Device metadata (e.g., operating system, serial number, enrollment date, last check-in)

Security posture (e.g., firewall status, encryption, antivirus, screen lock, password policy, audit logging, remote access status)

Operational data (e.g., system update status)

Software inventory (installed applications on the device)

Compliance state based on device and system information

Security and audit event data

Limited user-related signals (e.g., detected email addresses from local system sources)

compliance checks

enforcement

cleanup during offboarding

wipe actions for lost or stolen devices

Legacy Secureframe Agent removal is performed during enrollment when ownership is confirmed

Cleanup actions are best-effort and remove Secureframe-applied configurations without weakening the core security posture

Wipe actions are best-effort and vary by operating system

Monitoring mechanisms capture security-relevant activity and additional device context

device and system information

detected activity and events