Short answer: Level 1 asks you to know every device that can reach company information, and to keep other devices out.
- A list: every computer, phone and tablet that can reach company data, each matched to the person who uses it.
- Names you can recognize: each device on the list can be told apart.
- Only listed devices get in: old and unknown devices are removed, and a personal device is allowed only when you choose to allow it.
What the rule asks
Two practices cover devices, with three checks between them:
| Practice | The assessor checks that… |
|---|---|
| AC.L1-b.1.i | the devices allowed to connect to your systems are identified |
| AC.L1-b.1.i | access is limited to those devices |
| IA.L1-b.1.v | each device that accesses your systems is identified |
What good looks like
- One list of company computers, phones and tablets, plus any personal device you knowingly allow, each with its name, its type and the person who uses it.
- Device names you can recognize, such as "Jane Smith laptop", not "DESKTOP-8F3K2".
- No old or unknown device still able to reach company data.
How to do it in Microsoft 365
- Pull the device list. In Microsoft Entra (entra.microsoft.com), go to Identity → Devices → All devices. With Microsoft 365 Business Premium, the Intune admin center (intune.microsoft.com) has a fuller list under Devices → All devices.
- Check it against reality. Confirm that each device is a company machine or a personal device you knowingly allow, and look into anything you do not recognize.
- Remove old records. Delete device records that are stale or that you cannot place.
- Keep other devices out. With Business Premium, a Conditional Access policy can require a compliant or managed device. Without it, write down that company information is handled only on the devices on your list, and keep that true.
In Google Workspace, the device list is in the Admin console under Devices → Mobile & endpoints → Devices.
What proof to keep
- The device list, with each device's name, type and the person who uses it.
- How you keep other devices out: a screenshot of the policy, or your written rule.
- The date of your last review.
Common mistakes
- Personal phones that receive company email but are not on the list.
- An old laptop that can still sign in after it was replaced.
- Device names that say nothing about who uses them.
Do it step by step
The Computers and devices task in ReComply keeps this list with you: type the devices in, or upload the list you already have. It is one of the three tasks open on the Free plan.
Start free