Purpose 
To protect information against the risks introduced by using user endpoint devices. 

Other information 
Controls to protect information on user endpoint devices depend on whether the user endpoint device is used only inside of the organization's secured premises and network connections, or whether it is exposed to increased physical and network related threats outside of the organization. 
The wireless connections for user endpoint devices are similar to other types of network connections but have important differences that should be considered when identifying controls. In particular, back-up of information stored on user endpoint devices can sometimes fail because of limited network bandwidth or because user endpoint devices are not connected at the times when backups are scheduled. 
For some USB ports, such as USB-C, disabling the USB port is not possible because it is used for other purposes (e.g. power delivery and display output). 

Purpose
To ensure only authorized users, software components and services are provided with privileged access rights. 

Other information
Privileged access rights are access rights provided to an identity, a role or a process that allows the performance of activities that typical users or processes cannot perform. System administrator roles typically require privileged access rights. 
Inappropriate use of system administrator privileges (any feature or facility of an information system that enables the user to override system or application controls) is a major contributory factor to failures or breaches of systems. 
More information related to access management and the secure management of access to information and information and communications technologies resources can be found in ISO/IEC 29146. 

Purpose
To ensure only authorized access and to prevent unauthorized access to information and other associated assets. 

Other information
Dynamic access management techniques and other dynamic information protection technologies can support the protection of information even when data is shared beyond the originating organization, where traditional access controls cannot be enforced. It can be applied to documents, emails or other files containing information to limit who can access the content and in what way. It can be at a granular level and be adapted over the life cycle of the information.
Dynamic access management techniques do not replace classical access management [e.g. using access control lists (ACLs)], but can add more factors for conditionality, real-time evaluation, just-in-time data reduction and other enhancements that can be useful for the most sensitive information. It offers a way to control access outside the organization’s environment. Incident response can be supported by dynamic access management techniques as permissions can be modified or revoked at any time. 
Additional information on a framework for access management is provided in ISO/IEC 29146. 

Purpose
To prevent the introduction of unauthorized functionality, avoid unintentional or malicious changes and to maintain the confidentiality of valuable intellectual property. 

Other information 
If access to source code is not properly controlled, source code can be modified or some data in the development environment (e.g. copies of production data, configuration details) can be retrieved by unauthorized persons. 

Purpose
To ensure a user or an entity is securely authenticated, when access to systems, applications and services is granted. 

Other information 
Additional information on entity authentication assurance can be found is ISO/IEC 29115. 

Purpose
To ensure the required capacity of information processing facilities, human resources, offices and other facilities. 

Other information 
For more detail on the elasticity and scalability of cloud computing, see ISO/IEC TS 23167. 

Purpose
To ensure information and other associated assets are protected against malware. 

Other information
It is not always possible to install software that protects against malware on some systems (e.g. some industrial control systems). Some forms of malware infect computer operating systems and computer firmware such that common malware controls cannot clean the system and a full reimaging of the operating system software and sometimes the computer firmware is necessary to return to a secure state. 

8.8 Management of technical vulnerabilities

Control type #Preventive
Information security properties #Confidentiality #Integrity #Availability
Cybersecurity concepts #Identify #Protect
Operational capabilities #Threat_and_ vulnerability_ management
Security domains #Governance_and_Ecosystem #Protection #Defence