> For the complete documentation index, see [llms.txt](https://docs.nested-knowledge.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nested-knowledge.com/policies/policies/internal-policies/end-user-device-policy.md).

# End-User Device Policy

To mitigate risks and vulnerabilities individual personnel are responsible for ensuring that the computers and devices used to access Nested Knowledge services and systems are protected by basic security measures.

**Scope:** This policy affects all employees, contractors, and consultants of Nested Knowledge.

**Definitions:**

* **End-user device** refers to any desktop or laptop computer, any tablet, smart phone, or other mobile device is an end-user device. “End-user device” does not include removable storage like USB flash drives.
* **End-user** refers to a member of the Nested Knowledge workforce who accesses to information technology resources.

## End-User Device Policy

We require end-user devices to be protected by the security procedures described:

* Access to the device is protected with a password, PIN, or suitable biometric alternative.
* Where practicable, the screen or device locks after an inactivity timeout, and a password, PIN, or suitable biometric alternative is required to unlock it.
* Application updates, including security updates, are applied at least once every quarter.
* Where available, practicable, and advisable, a firewall is enabled.
* Anti-virus software is installed and automatic check for updates occurs at least weekly.
* Software or apps should not be installed unless the user explicitly trusts the source and knows a legal license exists.
* End-users must comply with software vendor license agreements and copyright holders’ notices. Making unauthorized copies of licensed and copyrighted software, even for evaluation purposes, is strictly forbidden.
* End-users are discouraged from storing client materials on their local machines; instead, files that are not in the production environment should be stored in centrally managed, encrypted storage.
* End-users are prohibited from connecting USB mass storage devices (e.g., flash drives, external hard drives, SD card readers) to company-managed computers. This restriction is enforced via Mobile Device Management (MDM) controls.

### Software Review

Nested Knowledge reviews the applications installed on end-user devices on a quarterly basis using our Mobile Device Management solution.

### Security Patches On End-User Devices

Nested Knowledge uses Mosyle to prompt end-users to download and install the latest software updates for the operating system (MacOS) and applications. For both OS and most application updates, if updates are not installed by the end-user within five (5) days of release, the updates are installed automatically. Nested Knowledge developers with root-access to their devices may choose to delay software updates, but they are required to update software within 3 months of the software release and notice.

## Anti-Malware Policy

We require Nested Knowledge end-users to run antivirus software on the company-issued computers. Software includes macOS built-in [anti-malware technologies](https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web) and Mosyle’s [Detection & Removal technology. ](https://school.mosyle.com/solutions/macos/detection)We require contractors using personal devices to use Malwarebytes to scan and detect malware and ransomware. Positive findings must be reported to the CTO. Antivirus software installs must be updated (either by updating ruleset or fresh reinstalling) whenever scans are performed.

#### Schedule

The schedule for scanning is subject to change, but it will not fall below the minimum of twice annually. Currently, Nested Knowledge end-user devices use macOS malware defense as well as Mosyle’s anti-virus tools. macOS’s built in technology [XProtect](https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web) updates signatures automatically when new malware infections and strains are detected.

#### Reporting

Positive results in the scan must be reported to one or more members of the [Incident Response team](/policies/policies/security-protection-privacy-and-recovery-policies/incident-management-and-response.md). If a virus is detected, all members of the IR team must be notified immediately.

#### Response

{% stepper %}
{% step %}

## Remove Offending Applications And Files

The offending applications and files will be uninstalled or removed until the report returns zero results.
{% endstep %}

{% step %}

## Analyze The Malware Attack Surface

The incident response team will analyze the malware attack surface and inventory the information that was available on the infected device since last scan.
{% endstep %}

{% step %}

## Enact Response And Data Protection Procedures

Based on the information available on the infected device, the appropriate Incident Response and Data Protection procedures will be enacted. Information about the threat will be escalated to clients/customers, according to the guidelines in our [escalation policy](/policies/policies/security-protection-privacy-and-recovery-policies/escalation-to-client-or-customer.md).
{% endstep %}
{% endstepper %}

## Enforcement

Failure to comply with this policy may result in disciplinary actions.

## Revision History

| Author     | Date of Revision/Review | Comments        |
| ---------- | ----------------------- | --------------- |
| J. Johnson | 01/08/2026              | Revised         |
| K. Cowie   | 10/23/2024              | Revised         |
| K. Holub   | 12/15/2021              | Policy approved |
| K. Kallmes | 12/18/2021              | Policy approved |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.nested-knowledge.com/policies/policies/internal-policies/end-user-device-policy.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.