Add hardware device controls

Signed-off-by: Bryan Frimin <bryan@frimin.fr>

controls/physical/hardware/PHY.HW.001_endpoint_antimalware.md

@@ -0,0 +1,44 @@
+---
+id: "PHY-HW-001"
+category: "physical/hardware"
+revision-version: 1
+revision-date: "2024-01-08"
+estimate-time: "30m"
+frameworks:
+  - name: "soc2"
+    sections: ["CC2.1", "CC6.1", "CC6.6", "CC6.7", "CC6.8", "CC7.1", "CC7.2"]
+---
+
+## Purpose
+
+Ensure all employee devices have active malware protection to prevent
+unauthorized and malicious software installation, protecting company data and
+systems from malware-based threats.
+
+## Implementation
+
+### MacOS
+
+1. Verify Gatekeeper is enabled (default)
+   - System Settings → Privacy & Security
+   - Ensure App Store and identified developers option
+
+### Windows
+
+1. Enable Windows Defender
+   - Settings → Update & Security → Windows Security
+   - Real-time protection enabled
+
+## Evidence
+
+**Option 1**: MDM solution
+- Screenshot of fleet malware protection status
+- Configuration compliance reports
+
+**Option 2**: Manual Documentation
+- Device inventory with protection status
+- Configuration screenshots
+
+
+
+

controls/physical/hardware/PHY.HW.002_device_screen_lock.md

@@ -0,0 +1,49 @@
+---
+id: "PHY-HW-002"
+category: "physical/hardware"
+revision-version: 1
+revision-date: "2024-01-08"
+estimate-time: "30m"
+frameworks:
+  - name: "soc2"
+    sections: ["CC2.1", "CC6.1", "CC6.6", "CC6.7", "CC6.8", "CC7.1", "CC7.2"]
+---
+
+## Purpose
+
+Implement automatic screen lock on all employee devices to prevent unauthorized
+access when devices are unattended, protecting against physical access to
+company data and resources.
+
+## Implementation
+
+### All Devices
+
+1. Configure automatic screen lock:
+   - Maximum 5-minute timeout
+   - Require password/biometrics to unlock
+   - Disable bypass options
+   
+### MacOS
+
+1. Apple menu → System Settings → Lock Screen
+2. Enable "Require password after screen saver begins"
+
+### Windows
+
+1. Settings → Personalization → Lock screen
+2. Enable "Require sign-in when PC wakes"
+
+
+## Evidence
+
+**Option 1**: MDM Solution
+- Screen lock policy compliance report
+- Configuration status dashboard
+
+**Option 2**: Manual Documentation
+- Screenshots of screen lock settings
+- Device compliance checklist
+
+
+

controls/physical/hardware/PHY.HW.003_device_encryption_and_firewall.md

@@ -0,0 +1,42 @@
+---
+id: "PHY-HW-003"
+category: "physical/hardware"
+revision-version: 1
+revision-date: "2024-01-08"
+estimate-time: "30m"
+frameworks:
+  - name: "soc2"
+    sections: ["CC2.1", "CC6.1", "CC6.6", "CC6.7", "CC6.8", "CC7.1", "CC7.2"]
+---
+
+## Purpose
+
+Ensure all employee devices have disk encryption and firewall protection enabled
+to secure data at rest and protect network communications from unauthorized
+access.
+
+## Implementation
+
+### MacOS
+
+1. Enable FileVault
+   - System Settings → Privacy & Security
+
+
+### Windows
+
+1. Enable BitLocker
+   - Control Panel → System and Security
+   
+   
+## Evidence
+
+**Option 1**: MDM Solution
+- Encryption status report
+- Device inventory status
+
+**Option 2**: Manual Documentation
+- Screenshots of encryption status
+- Device inventory with status
+
+