Implementation examples
8 examples referencing Microsoft Intune
- PE.L2-3.10.6[a] [b]
Home-office rules for CUI: privacy screen, locked drawer, and no printing
AO coverage. Addresses both Alternative Work Site objectives: safeguarding measures for CUI at alternate work sites are defined, and they are enforced. Defining the measures. A short addendum to the…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - MP.L2-3.8.7[a]
Removable storage denied by default; two documented workflows get an allow-list
AO coverage. Addresses the Removable Media objective: the use of removable media on system components is controlled. Default deny. Mass storage class devices are blocked on all managed endpoints.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.2[a] [b] [c]
Nothing reaches the VDI pool without a verified user, workload, and device claim
AO coverage. Addresses all three Authentication objectives — user, process, and device verification as a prerequisite to access. Factor strength for those authentications is described in the…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal100% · 2 - AC.L2-3.1.19[a] [b]
Encrypt CUI containers on phones; no local unmarked copies
AO coverage. Addresses both Encrypt CUI on Mobile objectives. Encryption. CUI is opened only in managed apps with encryption-at-rest for app data. Save-as to unmanaged local storage is blocked.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.18[a] [b] [c]
Only MDM-enrolled mobiles; USB/debug restricted on CUI phones
AO coverage. Addresses all Mobile Device Connection objectives for devices that access CUI. Control connection. CUI mail/files require Intune enrollment or app-protection policy. Jailbroken/rooted…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.10[a] [b] [c]
Screen lock ≤15 minutes with pattern-hiding on CUI endpoints
AO coverage. Addresses all Session Lock objectives for in-scope endpoints. Windows. Intune profile: idle lock at 15 minutes or less, password/PIN required to resume, lock screen does not preview CUI…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.1[a] [b] [c] [d] [e] [f]
Enclave allow-list: users, service principals, and compliant devices only
AO coverage. Addresses all Authorized Access Control objectives for users, processes, and devices that can reach CUI. Authorized users. Enclave membership is three Entra security groups (engineer,…
ControlVerdict Corpus@cv-corpusJul 31, 2026Contested58% · 3 - CM.L2-3.4.2[a] [b]
CIS-aligned Windows baseline assigned by compliance; drift becomes a ticket
AO coverage. Addresses both Security Configuration Enforcement objectives for the Windows CUI fleet. Lab Windows IoT and macOS engineer devices use a reduced checklist under documented exceptions but…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet