>You have two sub-problems here. Either you take endpoint security very seriously (which becomes its own much more important bullet point), or you trust employe

>You have two sub-problems here. Either you take endpoint security very seriously (which becomes its own much more important bullet point), or you trust employees to encrypt their devices on their own. This process should be entirely automated. My concrete criticism: mention this problem alongside endpoint security. Do you have any recommendations for endpoint security? I'm setting that up now and finding a good vendor has been annoying. >Precisely how are your engineers reviewing “basic” security without basic qualifications? There are standards and checklists for this (ie: OWASP Top Ten). Being able to read and follow a simple checklist, that someone recommends to you, doesn't mean you're even close to an expert in that area. That said, the OWASP Top 10 includes "Logging and Monitoring" on it while this checklist punts it to Series A, so it's confusing.