Installing Sophos Endpoint is only the first step. The effectiveness of endpoint protection ultimately depends on how Sophos Central policies are configured, assigned, monitored, and reviewed.
A default or poorly configured policy may leave critical security controls disabled or misconfigured. These controls include ransomware protection, application control, peripheral restrictions, web filtering, data loss prevention (DLP), account health monitoring, and tamper protection.
To help IT administrators, cybersecurity teams, and managed service providers (MSPs) conduct a structured security review, we developed the Sophos Endpoint Security Checklist 2026, which covers 25 recommended security controls across seven key security areas.
Important:
This checklist serves as a cybersecurity best-practice guide and assessment framework. The suitability of each setting depends on your industry, regulatory requirements, your subscribed Sophos license, business operations, security policies, and risk appetite. A setting appropriate for a healthcare provider or financial institution may not be necessary for a small business.
The 7 Security Areas
1. Threat Protection
Protects endpoints against malware, ransomware, exploits, malicious websites, and suspicious activity through real-time detection and automated response.
2. Peripheral Control
Controls removable media and external devices such as USB drives, Bluetooth devices, and mobile devices to reduce the risk of malware infection and data leakage.
3. Application Control
Restricts the use of unauthorized, non-business, or high-risk applications on corporate endpoints.
4. Data Loss Prevention (DLP)
Monitors sensitive information and helps prevent accidental or unauthorized disclosure of confidential data.
5. Web Control
Enforces safe browsing policies and blocks access to malicious, inappropriate, or high-risk websites.
6. Account Health
Reviews overall endpoint security posture, deployment coverage, protection status, and security recommendations within Sophos Central.
7. Tamper Protection
Prevents users and local administrators from disabling, modifying, or uninstalling Sophos protection without authorization.
Top 25 Recommended Sophos Security Controls
| No. | Security Area | Recommended Security Control |
|---|---|---|
| 1 | Threat Protection | Enable Live Protection |
| 2 | Threat Protection | Enable Real-Time Scanning |
| 3 | Threat Protection | Enable Deep Learning |
| 4 | Threat Protection | Enable Runtime Protection |
| 5 | Threat Protection | Enable Automatic Remediation |
| 6 | Threat Protection | Enable Ransomware Protection |
| 7 | Threat Protection | Review SSL/TLS Inspection Requirements |
| 8 | Threat Protection | Review and Minimise Security Exclusions |
| 9 | Peripheral Control | Review Bluetooth Device Access |
| 10 | Peripheral Control | Restrict Removable Storage Devices |
| 11 | Peripheral Control | Review Wireless and Network Bridging Access |
| 12 | Peripheral Control | Restrict MTP/PTP Mobile Device Access |
| 13 | Application Control | Block High-Risk Applications |
| 14 | Application Control | Control Remote Access and Remote Management Tools |
| 15 | Application Control | Restrict Download Managers and File-Sharing Applications |
| 16 | Application Control | Restrict Unauthorised Security and Administrative Tools |
| 17 | Data Loss Prevention | Detect Singapore NRIC Numbers |
| 18 | Data Loss Prevention | Detect Passport Numbers |
| 19 | Data Loss Prevention | Detect Credit Card Information |
| 20 | Data Loss Prevention | Review DLP Monitoring and Alert Rules |
| 21 | Web Control | Block Malicious and High-Risk Websites |
| 22 | Web Control | Block Risky File Types and Downloads |
| 23 | Web Control | Enable Web Activity Logging |
| 24 | Account Health | Review Sophos Central Account Health Recommendations |
| 25 | Tamper Protection | Enable Tamper Protection on All Endpoints |
How Should Organizations Use This Checklist?
The checklist should not be treated as a simple “Enabled” or “Disabled” exercise.
Each control should be assessed against:
- Industry requirements
- Regulatory obligations
- Internal security policies
- Business requirements
- Security risks
- User experience considerations
For example:
- A financial institution may choose to block USB storage completely.
- A design agency may require controlled USB access.
- A healthcare organization may require stricter DLP policies for patient records.
- A software development company may require approved scripting and development tools.
The goal is not to implement every setting blindly, but to ensure each setting has been reviewed, justified, documented, and approved.
Who Should Use This Checklist?
This checklist is suitable for:
- IT Managers
- System Administrators
- Cybersecurity Teams
- Internal Auditors
- Compliance Officers
- Data Protection Officers (DPOs)
How often should the Sophos Endpoint Security Assessment be performed?
At least annually, or whenever there are significant changes to:
- Security policies
- Regulatory requirements
- IT infrastructure
- Sophos licensing
- Business operations
- Cybersecurity threats
Higher-risk organizations may choose to review endpoint security quarterly.
Download the Checklist
Brina Teo is a cybersecurity practitioner specializing in Security Information and Event Management (SIEM), endpoint security, and Microsoft 365 security assessments. Her expertise includes Wazuh SIEM deployment, security monitoring, threat detection, incident investigation, and Sophos Endpoint Security administration. Brina holds a Diploma in Cybersecurity and Digital Forensics from Temasek Polytechnic and is passionate about security operations, cloud security, and cyber threat management.
Jamson Lim is an IT and cybersecurity professional with over 20 years of experience in cloud security, data protection, secure infrastructure, and compliance advisory. He holds a Master of Computing from the National University of Singapore (NUS) and an Advanced Diploma in Data Protection from Singapore Management University (SMU), and is certified as a Certified Ethical Hacker (CEH) and Certified Linux Systems Engineer (CLSE). Jamson advises SMEs, non-profit organizations, and charities on cybersecurity, data protection, ISO/IEC 27001, PDPA, MAS TRM, and healthcare security compliance.
