How should security measures be described when there is no jurisdiction over the hardware used by developers?

ANSWER

If the client supplies its own laptops and the organisation has no control over them, it is advisable to define and require adherence to minimum security standards, such as up-to-date software, disk encryption, and antivirus protection. Key measures include implementing conditional access (e.g. VPN plus MFA) and limiting local data storage – cloud or virtual environments may be a suitable solution. In addition, monitoring user access and activity will enable rapid detection of anomalies and potential threats. Compliance with these elements, as well as monitoring of that compliance, should be the subject of a risk analysis.