TL;DR
The first audit questionnaire makes it feel as though everything about devices in a regulated team has to change. Most of it does not. What genuinely changes is the evidence burden: you now have to prove what you were already doing, and proving it is a different job from doing it.
- The work does not change much. The evidence burden changes completely.
- Four controls carry most questionnaires: inventory, encryption, access, disposal.
- A dated record beats a good intention. Auditors read records.
- Scope the regulated group. Not every team needs the same controls.
- Disposal evidence is the one almost everybody is missing.
- Skip the theatre: device photographs, signed paper forms, asset stickers nobody scans.
What changes for devices in a regulated team
Three things, and only one of them is about equipment.
Evidence. You now have to show what you do, with dates, in a form somebody outside the company can read. This is the big one and it is mostly an administrative change rather than a technical one.
Scope definition. You have to say which systems, people and devices are in scope, and defend the boundary. Teams that skip this end up applying the strictest control to the whole company, which is expensive and unnecessary.
A small number of genuinely new controls, which vary by framework and are usually fewer than the questionnaire implies.
What does not change
The equipment itself, mostly. Regulated teams do not need different laptops, and a framework rarely names hardware.
What they need is the ability to answer, for any given device, who has it, whether it is encrypted, what it can reach, and what happened to it at the end. If you can already answer those four accurately, the compliance work is documentation rather than reconstruction.
If you cannot, the gap is in your register rather than in your policy, and that is the honest place to start.
The four controls that carry most questionnaires
| Control | What is asked | Evidence that satisfies it |
|---|---|---|
| Inventory | Do you know what you have and who has it | A register with owner, serial and date, reconciled |
| Encryption | Is data at rest protected on endpoints | A platform report per device, dated |
| Access | Can you show what each device and user reaches | Group membership plus a review record |
| Disposal | What happened to the data when the device left | A certificate or log per device |
Management standards such as ISO/IEC 27001, the information security management standard express these as control objectives rather than as a shopping list, and sector frameworks such as the Payment Card Industry Security Standards Council library of standards get more specific about scope and about what has to be documented. Either way the four above are where most device questions land.
The one almost everybody is missing
Disposal. Teams usually have some sort of register, some sort of encryption reporting and some sort of access model. Very few can produce, for a machine that left the fleet two years ago, a dated record of what happened to the data on it.
That is the gap that turns a smooth audit into a long one, because it cannot be fixed retrospectively. A device already resold has no certificate available later.
Fixing it forward is cheap: require a documented erasure for every device leaving the fleet from today, against a named standard such as NIST Special Publication 800-88 on media sanitization, and keep the record with the asset entry rather than in a supplier’s portal you will lose access to.
And the one most often overdone
Access reviews. The requirement is usually that reviews happen and are recorded. The common response is a quarterly spreadsheet exercise across the whole company that nobody reads, which produces worse security than an annual review actually done properly on the regulated scope.
Scope the group, not the company
Disclosure: RemoAsset, named below, is owned by the same people who publish PeopleOpsHQ. It is described with its limitations stated, on the same terms as every other supplier. This site takes no vendor money.
The instinct is to apply the strictest control everywhere, because the boundary feels risky to defend. It is also the most expensive possible answer and it degrades the controls themselves.
Define the regulated group deliberately. Usually it is the people who touch the regulated data or system, plus whoever administers the platforms they use, and that is a minority of the company in most cases.
Then apply the four controls properly to that group, and apply a lighter version everywhere else.
| Group | Inventory | Encryption evidence | Disposal evidence |
|---|---|---|---|
| Regulated scope | Reconciled quarterly | Per device, dated | Certificate per device |
| Administrators | Reconciled quarterly | Per device, dated | Certificate per device |
| Everyone else | Reconciled annually | Fleet level report | Documented process, sampled |
Why the narrow scope is also safer
Because controls applied to everybody get diluted until they are survivable, and a diluted control on the regulated group is the actual risk. A quarterly reconciliation of 40 devices is done properly; a quarterly reconciliation of 400 becomes a spreadsheet nobody checks.
The boundary does need defending in writing, with the reasoning stated and reviewed when the company changes shape. That document is worth more at audit than any single control, because it shows the thinking.
Where devices move in and out of the regulated group as people change roles, that is the moment the register goes wrong, and our guide to what happens to the laptop when somebody changes team covers the mechanism that catches it.
The decision table
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| First questionnaire arrived | Any | No formal controls | Do not know the gaps | Answer the four questions honestly, then fix |
| One regulated product line | 50 plus | Mixed company | Scope creep | Define the group in writing, defend it |
| Register is unreliable | Any | Spreadsheet | Cannot evidence inventory | Reconcile once properly before automating |
| No disposal records | Any | Devices resold informally | Cannot be fixed backwards | Require certificates from today |
| Audit in six weeks | Any | Partial evidence | Time | Document what is true, flag the rest |
What to skip
A surprising amount of device compliance work produces no evidence anybody asks for, and it crowds out the work that does. Four examples worth dropping, each of which costs real hours and satisfies nothing.
Photographing devices at issue. Common, time-consuming, and almost never requested. The serial number is the record; a photograph of a laptop proves nothing about its configuration.
Signed paper acceptance forms. A digital acknowledgement with a timestamp is better evidence and costs nothing to collect. Paper forms get lost, and a missing form reads worse at audit than a system record that shows the acknowledgement.
Asset stickers nobody scans. Useful in an office with a physical audit process. Useless on a fleet in forty homes, where nobody is ever going to walk around reading them.
Quarterly full-company access reviews. As above. Narrow the scope and do it properly.
What to do with the time instead
Two things, both unglamorous and both worth more than any of the above.
Reconcile the register once, properly. Every device, confirmed against a person and a serial number. It is a week of work and it makes every subsequent control meaningful, because a control applied to a wrong list is theatre by definition.
Build the evidence trail for devices leaving. Collection, documented wipe, and the certificate stored with the asset record. That is the chain auditors ask about and the one most teams cannot show.
Where devices come back and wait before reuse, the storage step is part of that chain rather than separate from it, and storage and redeployment of returned devices is where the custody record either continues or breaks. The limitation to state plainly: a supplier can give you a wipe certificate, and it cannot give you a reconciled register. That part is yours.
For the collection step itself, device retrieval with packaging arranged is the mechanism, and the evidence you want from it is a dated record per device rather than a monthly summary.
See where the custody record continues after collection at storage and redeployment of returned devices, or read our guide to what happens to the laptop on an internal move.
Frequently asked questions
What actually changes when a team becomes regulated?
Three things, and only one is about equipment. The evidence burden, meaning you must now show what you do with dates in a form an outsider can read. Scope definition, meaning you must say what is in and defend the boundary. And a small number of genuinely new controls, usually fewer than the questionnaire implies. The laptops themselves rarely change.
Which controls matter most?
Four. Inventory, meaning a register with owner, serial and date that has actually been reconciled. Encryption, meaning a dated per-device report rather than a belief. Access, meaning group membership plus a record that reviews happen. And disposal, meaning a dated record of what happened to the data when each device left. Most device questions land in those four.
Which one are most teams missing?
Disposal. Most have some register, some encryption reporting and some access model. Very few can produce, for a machine that left two years ago, a dated record of what happened to its data. That gap cannot be fixed retrospectively, because a device already resold has no certificate available later. Fixing it forward is cheap and should start today.
Should the whole company meet the same standard?
No, and applying the strictest control everywhere is both the most expensive answer and the one that degrades the controls. Define the regulated group as the people who touch the regulated data or system plus whoever administers their platforms, apply the four controls properly there, and run a lighter version elsewhere. Document the boundary and the reasoning.
Why is a narrow scope safer?
Because controls applied to everybody get diluted until they are survivable, and a diluted control on the regulated group is the real risk. A quarterly reconciliation of 40 devices gets done properly. The same exercise across 400 becomes a spreadsheet nobody checks, which looks like more compliance and delivers less.
What device compliance work can we skip?
Photographing devices at issue, which is time-consuming and almost never requested, since the serial is the record. Signed paper acceptance forms, because a timestamped digital acknowledgement is better evidence. Asset stickers on a fleet spread across homes, where nobody will ever read them. And quarterly full-company access reviews, which should be narrowed instead.
Where should the saved time go?
Two unglamorous things. Reconcile the register once, properly, every device confirmed against a person and a serial, because a control applied to a wrong list is theatre by definition. And build the evidence trail for devices leaving: collection, documented wipe, and the certificate stored with the asset record rather than in a portal you may lose access to.
PeopleOpsHQ covers the operational side of distributed work. We describe suppliers with their limitations stated, and we take no vendor money.
