What evidence does ISO 27001:2022 8.1 need?

Statement of Applicability entry for control A.8.1, showing inclusion or justified exclusion, implementation status and the risks it treats. The topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control. Device management (MDM or endpoint management) reports showing enrolment, encryption, patch level, firewall and anti-malware status

8.1 of ISO 27001:2022, stated here in our words and cited to that clause.

Does it map to the other framework?

The held record carries no reviewed link for this control, and does not invent one.

ISO 27001:2022 8.1 evidence: User end point devices

ISO 27001:2022 8.1: User end point devices

ISO 27001:2022 8.1 covers User end point devices. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.8.1, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Devices outside device management access corporate email and files.

Information that sits on, is handled by or can be reached through user endpoint devices is to be protected. Purpose (stated in ISO/IEC 27002:2022): shields information from the risks that endpoint devices bring. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.1.

What evidence supports 8.1?

Annex A technological controlStatement of Applicability entry for control A.8.1, showing inclusion or justified exclusion, implementation status and the risks it treats
Annex A technological controlThe topic-specific endpoint policy covering classification limits, registration, software restrictions, updates, network connection rules, encryption, malware protection, remote wipe, backup and port control
Annex A technological controlDevice management (MDM or endpoint management) reports showing enrolment, encryption, patch level, firewall and anti-malware status
Annex A technological controlConfiguration evidence for software installation restrictions, removable media or port controls and blocking of local storage for highly sensitive information
Annex A technological controlUser acknowledgement of endpoint responsibilities and, for BYOD, of data ownership and remote wipe terms

Where this requirement comes from

This is our own statement of ISO 27001:2022 8.1, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.

Common gaps an assessor flags

Devices outside device management access corporate email and files
Encryption is assumed but not verified on every device
BYOD is permitted without separation of business data or remote wipe consent
Lost device reports are slow because users do not know the procedure

How it maps to SOC 2

No reviewed link is held for this control.

A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.