Safeguard 10.4 Scan removable media automatically: evidence

What Safeguard 10.4 removable media scanning asks for in plain words

Safeguard 10.4 matters when an auditor or a customer asks you to show that USB drives and other removable media are scanned automatically before anyone opens their contents. The Safeguard sits in Implementation Group 2, so organizations that qualify only for IG1 are not measured against it. Confirm your Implementation Group before you spend time building evidence. If you are an IG2 or IG3 enterprise, the requirement is to configure your anti-malware software so that removable media is scanned automatically on the in-scope endpoints, rather than relying on people to remember to run a manual scan. CIS assigns the Safeguard to the Devices asset class and the Detect security function, which tells you it is about endpoints and about finding malicious content, not about policy writing alone.

The malware risk is simple to describe. A drive carried in from outside can carry a payload that never crosses your network perimeter, so email filtering, web proxies and firewalls do not see it. Disabling autorun, which is the IG1 step in Safeguard 10.3, stops a drive from launching code on insertion, but it does not inspect the files a user opens from that drive. Automatic scanning closes that gap, and it is the reason 10.4 exists as a separate step. Make sure the scanning engine in your anti-malware product is actually invoked on mount, not just installed on the device.

The hard part is usually proving coverage. Most organizations struggle with three things: an accurate inventory of which endpoints are in scope, configuration drift when a policy is changed on one group and not another, and the absence of a single view that shows the setting on every device. The CIS Controls Assessment Specification measures the Safeguard with a Coverage metric, the share of assets with properly configured software to automatically scan removable media. Plan to establish the secure configuration process in Safeguard 4.1 and the anti-malware deployment in Safeguard 10.1 first, because the Assessment Specification lists both as prerequisites. Ask your anti-malware vendor how the removable media setting is exposed for reporting, and confirm that the exported status can be matched against your asset inventory.

Which endpoints, media and teams fall under removable media scanning

Before configuring automatic scanning, decide which Implementation Group applies, which systems count as enterprise assets, and who owns each layer. Safeguards 4.1 and 10.1 must already be in place, because the assessment measures 10.4 only on assets where anti-malware and a secure configuration process exist.

Implementation Group scope

Safeguard 10.4 sits in IG2, so it applies to IG2 and IG3 enterprises but not to IG1-only organizations. Confirm your group against the CIS Implementation Groups definitions before committing effort. An IG1 organization still needs to disable autorun under 10.3, and can treat automatic scanning as a later improvement. Document the group decision in the scope statement so an assessor can trace why 10.4 is in or out.

Devices in the asset inventory

The Devices asset class covers the endpoints the enterprise owns, manages or allows on its network, including laptops, desktops and mobile devices where they connect to enterprise data. Scope from the Control 1 asset inventory rather than from memory, since an assessor will compare the two. Any endpoint missing from the inventory is missing from the Coverage measure, so unmanaged devices should be found and either enrolled or excluded with a documented reason.

Servers, kiosks and virtual desktops

Decide explicitly whether servers, kiosks, point-of-sale terminals and virtual desktop sessions are in scope. Persistent virtual desktops usually behave like endpoints and need the same anti-malware and removable media settings. Non-persistent sessions depend on how the image is built and whether USB redirection is allowed. Record the decision per platform and confirm that the anti-malware product supports scanning on each one, since some server and appliance platforms expose removable media differently.

Removable media types

Treat USB flash drives, external hard disks, SD cards and optical media as separate cases in the policy. Each type mounts differently and some are read-only by design, so the scanning trigger must be tested against each one. Confirm with the anti-malware vendor how scanning is triggered on mount and whether it covers encrypted or large volumes. Write the chosen behavior into the standard so that the Coverage measure has a clear definition of properly configured.

Prerequisites: 4.1 and 10.1

The assessment lists Safeguard 4.1, the secure configuration process, and Safeguard 10.1, deployment and maintenance of anti-malware, as prerequisites for measuring 10.4. Scanning settings cannot be verified on a device where the agent is absent or where configuration drifts outside an approved baseline. Confirm both controls are operating on the same asset population before testing 10.4, and keep the baseline and deployment reports as evidence.

Console and build ownership

Split ownership explicitly. The security or endpoint team usually owns the anti-malware console and its scanning policy, while the platform or endpoint build team owns the images and the group policy or configuration profiles that apply them. Name one accountable owner for the Coverage measure and agree how changes move between the two teams. Without that agreement, a policy change in the console can be undone by a build that was never updated.

Why disabling autorun under 10.3 does not satisfy removable media scanning

Safeguard 10.4 asks for something that Safeguard 10.3 does not provide. Safeguard 10.3 is a configuration setting: turning off autorun and autoplay stops Windows from launching code the moment a USB drive or optical disc is inserted. That removes one automatic execution path, but it does not inspect a single file on the media. A user can still double-click an infected document, open a script, or run an installer from the drive, and nothing in the autorun setting will look at it. Safeguard 10.4 closes that gap by requiring the enterprise's anti-malware software itself to scan removable media automatically, so the file is examined before anyone opens it. Because 10.4 sits in Implementation Group 2 and 10.3 sits in IG1, an IG2 enterprise should treat disabled autorun as a prerequisite and not as the finished control.

The practical question for the assessor is therefore whether the anti-malware product is configured to scan removable media without a user having to start a scan. Ask the endpoint team to show the policy that governs scan-on-attach or a scheduled removable media scan in the central console, and to confirm which device classes the policy targets. Check that the setting applies to every managed endpoint in the Devices asset class, not only to a pilot group or to laptops. Also confirm that the scan result feeds the same detection record as other malware events, so an alert is raised and reviewed. The Coverage metric in the CIS Controls Assessment Specification measures the share of assets with properly configured software to scan removable media automatically, so a policy that exists in the console but has not reached a segment of the fleet will not count in full. The CIS Controls Assessment Specification for Safeguard 10.4 sets out the measures in detail.

Before the assessment, plan for two dependencies. Safeguard 4.1, the secure configuration process, and Safeguard 10.1, the deployment of anti-malware software, are prerequisites for measuring 10.4, so the evidence for removable media scanning is only as strong as the baseline configuration and the coverage behind it. An endpoint without the agent, or an agent whose policy was overridden locally, will fail the measure even if the console policy is correct. Ask your anti-malware vendor how its product reports the removable media setting for each endpoint, and whether that report can be exported for the assessor. Where you use open-source tooling for evidence, osquery can query a host's state across a fleet, but confirm with your vendor and your own testing that the specific scan-on-attach setting is visible to the query you write before you rely on it.

How an assessor tests Safeguard 10.4 on endpoints

This table walks through the steps an assessor takes to test Safeguard 10.4, from the Coverage metric down to a single removable media insertion. Read it as a sequence: confirm the prerequisites and scope first, then check policy, then the effective setting on sampled devices, then behavior and logs. The main takeaway is that a correct policy export does not prove coverage until the effective setting and the unmanaged endpoint count agree with it.

Test step	What the assessor samples or inspects	Evidence requested	Common findings
Confirm scope and the Coverage metric	The population of in-scope endpoints and the share of them that the assessment counts as having properly configured automatic removable media scanning	Asset inventory export with device type, owner group and management status; the calculation behind the coverage figure	Inventory omits laptops, virtual desktops or servers that accept removable media
Verify prerequisite Safeguard 4.1	The documented secure configuration process that governs how anti-malware settings are approved, deployed and reviewed	Current configuration standard, change records for the anti-malware policy, approval history	Settings changed directly in the console with no recorded approval
Verify prerequisite Safeguard 10.1	That anti-malware software is installed and running on each sampled device, since removable media scanning depends on it	Deployment report from the console, service status on sampled hosts	Agent present but stopped, or installed on some device types only
Export and read the anti-malware policy	The policy that governs removable media scanning, including trigger conditions such as scan on attach and the scope of media types covered	Policy export file with version history and the list of group or device assignments	Policy exists but is not assigned to every group, or scanning is set only for a subset of media types
Check the effective setting on sampled devices	On a sample across workstations, laptops, servers and any kiosk or lab devices, the setting the endpoint actually applies after policy inheritance and local overrides	Screenshots or command output showing the effective configuration, collected per sampled device	Scan-on-attach disabled for some device types, local overrides that differ from policy, or policy failing on devices that were offline at deployment
Test a removable media insertion	Insert a test USB device on sampled endpoints and observe whether a scan starts automatically and the result is recorded	Timestamped scan log entry or console detection event tied to the test device and endpoint	No event generated, scan runs only when the user opens the drive, or scans complete without a logged result
Review scan logs across the fleet	Aggregated scan records for removable media over the review period, checked for gaps in devices that should report	Log extract or console report with device identifiers and dates	Devices that never report removable media events, which may indicate the setting is not in effect
Identify unmanaged endpoints	Endpoints that appear on the network or in asset discovery records but are absent from the anti-malware console	Reconciliation of console device list against asset inventory and network discovery output	Unmanaged devices outside the console, which count against coverage and cannot be shown to be configured

Implementing automatic removable media scanning step by step

This sequence takes an enterprise from confirming that Safeguard 10.4 applies to it to a documented, centrally verified configuration that can be measured with the Coverage metric. Each step names the artifact it produces so the work can be handed to an assessor.

Confirm IG2 scope and prerequisites
Confirm that the enterprise is in Implementation Group 2 or 3, since Safeguard 10.4 does not apply to IG1 only organizations. Check that Safeguard 4.1 (secure configuration process) and Safeguard 10.1 (anti-malware deployed on enterprise assets) are already in place, because the assessment specification lists both as prerequisites. The output is a short scope note naming the in-scope Devices assets and the owner of each prerequisite. The step is done when the owner of 4.1 and 10.1 has confirmed their status in writing.
Select and confirm the anti-malware product
Identify the anti-malware product deployed under Safeguard 10.1 and confirm with the vendor, or in the product documentation, that it can scan removable media automatically when a device is attached. Record the product version and the feature or setting name that controls this behavior. Where the current product cannot do this, document the gap and the decision on how to close it before going further. The output is a product capability record that the assessor can trace back to a vendor source.
Define the removable media scanning policy
Write the anti-malware policy that enables scanning on device attachment and sets scheduled scans of removable media. Decide who may override the policy, how scan exceptions are approved, and how detections are routed to the security team. Keep the policy in version control so changes are traceable. The output is the approved policy document and its exported configuration file, which later steps apply and the baseline records.
Apply the policy by device group
Assign the policy to defined device groups in the central console, starting with groups that match the in-scope asset inventory from Safeguard 1.1. Confirm that groups cover laptops, workstations and any other Devices assets that accept removable media. Record which groups receive the policy and which assets fall outside it with a reason. The output is a group-to-policy mapping that ties every in-scope device to a configuration.
Test on a pilot group
Run a controlled test on a small pilot group before wider rollout. Attach a test drive containing a benign test file and a file that the product's test procedure recognizes as a detection, then confirm the scan runs, the event is logged and the alert reaches the right queue. Repeat for a scheduled scan. Use only test material approved by the security team. The output is a dated test record with the result for each device in the pilot, and any fixes made to the policy.
Verify results on the central console
After rollout, check the central management console to see which devices report the removable media scanning setting as active and which report it as missing or failing. Investigate devices that do not appear, including offline laptops and machines that rejoined after policy changes. The output is a console export listing each in-scope device and its policy status, reviewed and signed off by the owner of Safeguard 10.6 management, where that function is separate.
Document the configuration baseline
Write a configuration baseline that records the product and version, the policy settings, the device groups, the exception list with approvals, and the test evidence from the pilot. Store it with the Safeguard 4.1 secure configuration records so the assessor can follow the chain from the requirement to the setting. The output is a versioned baseline document, and the step is complete when the owner has approved it.
Set up recurring Coverage checks
Schedule a recurring check that calculates the Coverage metric from the assessment specification: the share of in-scope assets that have the removable media scanning configuration applied. Define the frequency and the owner, the data source (console export or endpoint query), and the action taken when coverage falls short. Open-source endpoint query tools such as osquery can help gather configuration state across hosts, but confirm that the product's setting is readable through the tool before relying on it. The output is a recurring report and a documented remediation path for gaps.

Evidence that shows removable media scanning is configured and working

An assessor testing Safeguard 10.4 needs to see the configuration, the scope it covers and proof that it runs on real removable media events. The cards below cover the artifacts that connect those three points, and each one should be refreshed on a set schedule so the evidence matches the Coverage metric the CIS Controls Assessment Specification uses.

Exported anti-malware policy settings

Export the anti-malware policy that governs removable media and keep the file with its version, date and the name of the person who exported it. Check that the setting enabling automatic scanning of removable media is on, and that the policy is not overridden by a local setting on the endpoint. Store a fresh export on a schedule so the policy shown to an assessor is the one in force, not a copy from the time of rollout. Because the policy must be on, not merely present, an export showing the setting disabled is a finding even if the product is installed.

Device groups the policy applies to

List the device groups, organizational units or policy assignments that receive the removable media scan policy. Compare this list against the asset inventory produced under Control 1 and the devices in scope for Safeguard 10.1 so you can show which Devices asset class members are covered. Gaps usually appear in laptops that roam, kiosks and servers that accept media, so name them explicitly in the list. Record who approved each exclusion and why it exists.

Coverage reports per asset

Pull the console report that shows, for each asset, whether the removable media scan setting is applied and whether the agent reports it as compliant. This is the artifact that maps most directly to the Coverage metric, which is the share of assets with properly configured software to automatically scan removable media. Confirm with your vendor which report fields show policy application and which show agent health, since the two can differ. Keep dated copies so trend changes can be explained.

Sample scan logs from removable media events

Collect logs showing that the scanner actually examined inserted media, including the device identifier, the time, the scan result and the action taken on any detection. Select samples from several endpoints and several months, and include at least one event with a detection if your environment has produced one. Logs are only useful if they are retained long enough to cover the audit period, so confirm retention settings with the vendor and the central log platform. Under Control 8 logging, these records may also feed your central log management.

Change records for policy edits

Keep a change record for every edit to the removable media policy, covering the requester, approver, date, the setting changed and the reason. An assessor will compare the current configuration against these records to confirm that no one weakened scanning without approval. Tie each change to a ticket in your change management system. Exports from the console's audit log can supplement the tickets, but they should be checked against them rather than accepted alone.

Secure configuration baseline from Safeguard 4.1

Safeguard 4.1 requires a documented secure configuration process, and the assessment specification lists it as a prerequisite for measuring Safeguard 10.4. Include the baseline that sets removable media scanning as a required configuration, the review cycle for that baseline and the record of its last review. Show how the removable media setting is derived from the baseline, so the policy export can be traced back to a documented requirement. Confirm the review frequency in your own process document rather than assuming one.

What meeting Safeguard 10.4 costs in money and effort

This table breaks the cost of Safeguard 10.4 into the components an enterprise pays for, whether each is one-time or recurring, what pushes it up or down, and how to keep it contained. Most of the spend sits in configuring and proving automatic removable media scanning on endpoints the organization already runs, so the licensing question comes first.

Cost component	One-time or recurring	What drives it up or down	How to keep it down
Anti-malware licenses or existing suite features	Recurring	Whether the product you already license includes automatic removable media scanning, and whether that feature is in the tier you hold. Confirm with the vendor before budgeting new spend.	Check existing licenses and tier entitlements first. Avoid buying a product only to get one scanning setting.
Engineering time to configure policy	One-time, with later changes	Number of endpoint operating systems, device types and management tools, plus how many distinct scan policies are needed for different user groups.	Use one documented baseline policy, apply it through the existing central management console, and limit exceptions to written, approved cases.
Prerequisite work on Safeguards 4.1 and 10.1	One-time, shared with other Control 4 and Control 10 work	The assessment specification treats secure configuration process (4.1) and anti-malware deployment (10.1) as prerequisites. Gaps there add work before 10.4 can be measured.	Reuse the configuration baseline and deployment inventory already built for those Safeguards rather than rebuilding them for 10.4.
Pilot and testing time	One-time	Number of test cases: USB drives with known-clean files, known-test detection files, and devices with mixed operating systems. Heavy scan configurations can also slow endpoints and generate user complaints.	Pilot on a small device group, record results, and agree on acceptance criteria in writing before rollout.
Evidence upkeep (coverage reporting)	Recurring	How often coverage must be re-proven, how many devices change status, and whether the console can export a per-asset report. Open-source query tools such as osquery can reduce separate license spend for fleet-wide checks, but scanning itself remains a product feature.	Schedule the coverage query, store the output with dates, and reconcile it against the asset inventory from Control 1 instead of collecting screenshots.
External review or assessor support	Recurring, per assessment cycle	Scope of the assessment, number of endpoints sampled, and whether an outside party reviews configuration before the independent assessor does. Implementation partners prepare evidence; only independent assessors issue reports or certifications.	Ask for a written scope that names the Safeguard, the asset population and the deliverables. Keep evidence organized so the assessor is not searching for it.
Auditor sampling effort	Recurring	Number of devices and removable media events the assessor samples, and whether the organization can show the policy, the coverage report and exception records for the same period.	Keep one current policy record, a coverage report per period, and a dated exception log so sampling does not require manual reconstruction.
Ongoing policy and exception management	Recurring	Frequency of new device types, changes to removable media use, and changes to the anti-malware product. Each change can alter scanning behavior and needs re-verification.	Route changes through the existing change process and re-run the coverage check after each change.

How osquery, Fleet, Wazuh and Velociraptor support the evidence

None of the four tools scans removable media. Each one helps an enterprise show that its anti-malware and endpoint configuration is in place across a fleet, which is the evidence an assessor needs for Coverage under Safeguard 10.4. Confirm in your own environment which setting each tool can verify before you rely on it.

Query endpoint state with osquery

osquery exposes running processes, loaded kernel modules, open network connections, browser plugins, hardware events and file hashes as SQL tables. Its osqueryd daemon schedules those queries to run across an entire fleet of hosts. For Safeguard 10.4, the useful question is whether the anti-malware product's configuration or service is present and running on each endpoint, and whether it is reported on a schedule. Confirm that the table or file that holds your anti-malware setting is readable by osquery on each operating system you run. Licensed under Apache-2.0 OR GPL-2.0-only.

Pass or fail checks with Fleet

Fleet policies are yes or no questions written as osquery queries. The policies page shows which devices on each fleet pass or fail each policy. A policy can check that a required anti-malware or removable media setting is present on every device, which turns the assessor's Coverage question into a dated, per-device list. Write the policy around the specific setting your organization uses, then test it on a device that is known to be misconfigured. Licensed under MIT.

Check configuration against CIS benchmarks with Wazuh

Wazuh's Security Configuration Assessment scans monitored endpoints for misconfigurations using YAML policies. Most policies are based on CIS benchmarks and can be extended with custom policies. The checks cover files, directories, registry keys and running processes, and each failed check comes with a remediation recommendation. Use it to confirm that the configuration that supports Safeguards 4.1 and 10.1 is in place before you measure 10.4. Confirm that a policy exists for the removable media and anti-malware settings you need, or write one. Licensed under GPL-2.0-only.

Investigate across systems with Velociraptor

Velociraptor collects forensic artifacts defined in VQL from endpoints. A hunt collects one or more artifacts across a group of systems, schedules offline machines to collect when they reconnect, and creates a notebook per hunt for analyzing the combined results. After a malware event, a hunt can show which endpoints still have removable media auto-scan disabled or whose anti-malware product logged no scan. Confirm that your artifacts can read the scan configuration on each platform. Licensed under AGPL-3.0-only, so review the obligations before you modify or host it for others.

Who owns Safeguard 10.4, who can help and where the auditor stops

Your organization owns Safeguard 10.4. That means the decision that removable media must be scanned, the anti-malware policy that enforces it, the device groups it applies to, and the evidence that shows it works all sit with your security and endpoint teams. The Coverage figure the CIS Controls Assessment Specification uses, the share of assets with properly configured software to automatically scan removable media, is your number to calculate, explain and defend.

Policy decisions: set the scan-on-insert behavior, exclusions and any exceptions, and record who approved them.
Device groups: keep the list of in-scope endpoints current so the Coverage denominator is accurate.
Prerequisites: own Safeguards 4.1 and 10.1, which the assessment specification lists as prerequisites for measuring 10.4.
Evidence: retain configuration exports, policy versions and scan logs that an assessor can sample.
Exceptions and drift: review endpoints that fail the check and track remediation to closure.

Before any outside party starts work, confirm that someone in your organization can explain the Coverage calculation without help.

Where removable media scanning usually fails an assessment

Safeguard 10.4 is usually lost in the details rather than in the principle: the scan setting exists somewhere, but not on every device the assessment counts. The cards below cover the gaps that most often separate a configured policy from evidence an assessor can test against the Coverage metric.

Scan-on-attach set but not applied everywhere

A removable media scan policy is often written once and assigned to desktops only, leaving laptops, VDI sessions and kiosks outside its scope. Under the Coverage metric, every asset that can accept removable media counts, so one unassigned group lowers the result. Check the policy assignment report against the full device inventory, and confirm that virtual desktop images carry the same anti-malware configuration as physical endpoints.

Disabled autorun treated as the control

Turning off autorun under Safeguard 10.3 stops automatic execution, but it does not inspect files a user opens manually from a USB drive. Teams that stop there often cannot show that removable media is scanned at all. Confirm that the anti-malware product itself is configured to scan removable volumes on attach, and keep 10.3 as a separate, supporting setting.

Unmanaged and BYOD endpoints left out

Personal devices or contractor laptops that connect to enterprise systems may never appear in the anti-malware console, so their removable media scanning is invisible to the Coverage calculation. An assessor who finds an unmanaged device with a USB port will ask why it was not counted. Reconcile network discovery records with the anti-malware console, and document how unmanaged devices are blocked or restricted from removable media.

No evidence tied to coverage

Screenshots of a policy page do not show which assets are actually configured. Assessors look for an export that lists each asset, its scan setting and its last check-in, so the numerator and denominator of the Coverage metric can be recalculated. Ask the owner of the anti-malware console for a dated, per-device export and keep the query used to produce it.

Policy drift after reimaging

Images rebuilt from an older template, or machines restored from backup, can revert the scan configuration without anyone noticing. The gap appears months later, when a reimaged fleet reports as compliant on paper but has no removable media scanning. Compare configuration state after each rebuild, and use continuous checks on endpoint settings rather than relying on an annual review. Osquery and Fleet policies can run this check across hosts.

No test that a scan ran

A setting that says scanning is on does not prove that a USB drive was scanned when it was attached. Teams should run a controlled test with a known harmless test file on a sample of endpoints, then check the anti-malware log for the scan event. Record the test date, device, file and log entry, and repeat the test after configuration changes so the evidence stays current.

Questions buyers ask about Safeguard 10.4 before hiring help

Does an IG1 organization have to scan removable media automatically under Safeguard 10.4?

No. Safeguard 10.4 is assigned to Implementation Group 2 and Implementation Group 3, so an organization that only meets IG1 is not expected to measure it. IG1 covers the baseline in Safeguard 10.3, which turns off autorun and autoplay for removable media. Organizations at IG1 should still confirm the scope of their own contracts, customer questionnaires or regulator requirements, because those documents can ask for controls that CIS places at a higher Implementation Group. If you are moving from IG1 to IG2, treat 10.4 as the next step after confirming that your anti-malware deployment (Safeguard 10.1) and secure configuration process (Safeguard 4.1) already work across the fleet.

How much effort does it take to configure automatic removable media scanning?

The effort depends on the drivers, not on a fixed figure. The main drivers are the number of endpoints and operating system types, how many anti-malware products are in use, whether settings are managed from a central console or by hand on each device, how many device groups need different policies, and how much testing your change process requires before a policy goes live. Maturity of the existing baseline matters too: if Safeguards 4.1 and 10.1 are already documented and measured, the work is mostly configuration and verification. Ask any provider for a written breakdown of these drivers in the scope, and ask which parts are one-time (design, initial policy, testing) and which recur (policy review, exception handling, reporting).

Can our own team implement Safeguard 10.4 without outside help?

Yes, if your team already has an anti-malware console with policy control over removable media, administrators who can read and change those policies, and a way to confirm the settings reached each device. The Coverage metric in the CIS Controls Assessment Specification asks what share of assets have properly configured scanning, so the team needs a method to read that state across the fleet, not just on a sample of machines. Outside help is most useful when the console does not expose the setting clearly, when the fleet is split across several tools, or when the team lacks time to document the result as evidence. DeployOpen can prepare and document these systems under a written scope, but the configuration remains your responsibility.

How long does a removable media scanning project take?

The duration depends on fleet size, the number of anti-malware products and policy groups, change approval cycles, and whether the team needs to verify coverage on every device or on a representative set. No duration is given here because none has been established for this Safeguard. Ask for a timeline in the written plan that lists the phases (inventory of current settings, policy design, pilot, rollout, verification and evidence capture), the owner of each phase and the dependencies on other work. A plan that does not name dependencies on Safeguards 4.1 and 10.1 should be questioned.

What does our team need to provide before work begins on Safeguard 10.4?

Most engagements need four things in place before work starts: administrative access to the anti-malware console or the management tooling that controls removable media policy, a current device inventory so the Coverage metric has a denominator, a documented change approval path for endpoint policy changes, and named contacts who can accept test devices and approve rollout waves. Access should be granted under your own accounts and privileges, and the scope should state who holds each credential after the work ends. Ask the provider to confirm in writing which of these items it needs and which it expects you to supply.

Can a partner decide whether we pass the Safeguard 10.4 assessment?

No. A partner can configure systems, collect the settings and prepare the evidence, but only an independent auditor, assessor or certification body issues a conclusion on whether a control is met. CIS publishes the Assessment Specification to define what to measure, and CIS states that the Controls do not replace any regulatory, compliance or authorization scheme. Your organization owns the control and its outcome. When you engage an assessor, ask how they will test Safeguard 10.4 on endpoints, which sample and evidence they expect and how they treat devices that were offline during testing.

How DeployOpen scopes and prepares evidence for Safeguard 10.4

DeployOpen works on Safeguard 10.4 as a fixed-scope engagement inside your own infrastructure. We agree in writing which removable media scanning configurations, endpoints and evidence are in scope, then prepare the systems and documentation an independent assessor will review.

How we scope

Confirm which endpoints are IG2 or IG3 assets where Safeguard 10.4 applies, and record the anti-malware products in use.
Agree whether Safeguard 4.1 and 10.1 prerequisites are already documented and in place, or need work first.
Define the Coverage measure in writing, including how assets are counted and which removable media paths are covered.

How we build

Configure anti-malware policies so removable media is scanned automatically on insertion, consistent with your written standard.
Set up osquery or Fleet policy queries to report, per device, whether the automatic scan configuration is present.
Test the configuration on representative endpoints, recording results and exceptions before rollout across the fleet.

How we hand over

Deliver the written configuration standard, policy exports and device-level results your assessor will request.
Document the scope, the Coverage calculation method, known exceptions and the owner for each remediation item.
Walk your security and compliance teams through the evidence so they can answer assessor questions on their own.

How we support

Engagements are fixed-scope, so changes to endpoints or anti-malware products are agreed in writing before work starts.
Ongoing support, upgrades and continuous checks of removable media scanning are available as a retainer.
Your organization owns the control. DeployOpen prepares systems and evidence, and only an independent assessor issues findings.