From df5ecf23d382ac9ae2174664b2f7a6f8f08d33c3 Mon Sep 17 00:00:00 2001
From: gearnode <bryan@frimin.fr>
Date: Wed, 8 Jan 2025 11:52:23 +0100
Subject: [PATCH] Add hardware device controls

Signed-off-by: Bryan Frimin <bryan@frimin.fr>
---
 .../PHY.HW.001_endpoint_antimalware.md        | 44 +++++++++++++++++
 .../hardware/PHY.HW.002_device_screen_lock.md | 49 +++++++++++++++++++
 ...Y.HW.003_device_encryption_and_firewall.md | 42 ++++++++++++++++
 3 files changed, 135 insertions(+)
 create mode 100644 controls/physical/hardware/PHY.HW.001_endpoint_antimalware.md
 create mode 100644 controls/physical/hardware/PHY.HW.002_device_screen_lock.md
 create mode 100644 controls/physical/hardware/PHY.HW.003_device_encryption_and_firewall.md

diff --git a/controls/physical/hardware/PHY.HW.001_endpoint_antimalware.md b/controls/physical/hardware/PHY.HW.001_endpoint_antimalware.md
new file mode 100644
index 000000000..22e97e60b
--- /dev/null
+++ b/controls/physical/hardware/PHY.HW.001_endpoint_antimalware.md
@@ -0,0 +1,44 @@
+---
+id: "PHY-HW-001"
+category: "physical/hardware"
+revision-version: 1
+revision-date: "2024-01-08"
+estimate-time: "30m"
+frameworks:
+  - name: "soc2"
+    sections: ["CC2.1", "CC6.1", "CC6.6", "CC6.7", "CC6.8", "CC7.1", "CC7.2"]
+---
+
+## Purpose
+
+Ensure all employee devices have active malware protection to prevent
+unauthorized and malicious software installation, protecting company data and
+systems from malware-based threats.
+
+## Implementation
+
+### MacOS
+
+1. Verify Gatekeeper is enabled (default)
+   - System Settings → Privacy & Security
+   - Ensure App Store and identified developers option
+
+### Windows
+
+1. Enable Windows Defender
+   - Settings → Update & Security → Windows Security
+   - Real-time protection enabled
+
+## Evidence
+
+**Option 1**: MDM solution
+- Screenshot of fleet malware protection status
+- Configuration compliance reports
+
+**Option 2**: Manual Documentation
+- Device inventory with protection status
+- Configuration screenshots
+
+
+
+
diff --git a/controls/physical/hardware/PHY.HW.002_device_screen_lock.md b/controls/physical/hardware/PHY.HW.002_device_screen_lock.md
new file mode 100644
index 000000000..978440d2d
--- /dev/null
+++ b/controls/physical/hardware/PHY.HW.002_device_screen_lock.md
@@ -0,0 +1,49 @@
+---
+id: "PHY-HW-002"
+category: "physical/hardware"
+revision-version: 1
+revision-date: "2024-01-08"
+estimate-time: "30m"
+frameworks:
+  - name: "soc2"
+    sections: ["CC2.1", "CC6.1", "CC6.6", "CC6.7", "CC6.8", "CC7.1", "CC7.2"]
+---
+
+## Purpose
+
+Implement automatic screen lock on all employee devices to prevent unauthorized
+access when devices are unattended, protecting against physical access to
+company data and resources.
+
+## Implementation
+
+### All Devices
+
+1. Configure automatic screen lock:
+   - Maximum 5-minute timeout
+   - Require password/biometrics to unlock
+   - Disable bypass options
+   
+### MacOS
+
+1. Apple menu → System Settings → Lock Screen
+2. Enable "Require password after screen saver begins"
+
+### Windows
+
+1. Settings → Personalization → Lock screen
+2. Enable "Require sign-in when PC wakes"
+
+
+## Evidence
+
+**Option 1**: MDM Solution
+- Screen lock policy compliance report
+- Configuration status dashboard
+
+**Option 2**: Manual Documentation
+- Screenshots of screen lock settings
+- Device compliance checklist
+
+
+
diff --git a/controls/physical/hardware/PHY.HW.003_device_encryption_and_firewall.md b/controls/physical/hardware/PHY.HW.003_device_encryption_and_firewall.md
new file mode 100644
index 000000000..5e94b9378
--- /dev/null
+++ b/controls/physical/hardware/PHY.HW.003_device_encryption_and_firewall.md
@@ -0,0 +1,42 @@
+---
+id: "PHY-HW-003"
+category: "physical/hardware"
+revision-version: 1
+revision-date: "2024-01-08"
+estimate-time: "30m"
+frameworks:
+  - name: "soc2"
+    sections: ["CC2.1", "CC6.1", "CC6.6", "CC6.7", "CC6.8", "CC7.1", "CC7.2"]
+---
+
+## Purpose
+
+Ensure all employee devices have disk encryption and firewall protection enabled
+to secure data at rest and protect network communications from unauthorized
+access.
+
+## Implementation
+
+### MacOS
+
+1. Enable FileVault
+   - System Settings → Privacy & Security
+
+
+### Windows
+
+1. Enable BitLocker
+   - Control Panel → System and Security
+   
+   
+## Evidence
+
+**Option 1**: MDM Solution
+- Encryption status report
+- Device inventory status
+
+**Option 2**: Manual Documentation
+- Screenshots of encryption status
+- Device inventory with status
+
+