A verified identity on an unpatched laptop with no disk encryption is still a problem. Device posture is the part of zero trust that manufacturing teams postpone, usually because the last attempt flooded the help desk. This post is about the four checks worth enforcing and how to turn them on without that flood.
Four checks cover most of the risk: disk encryption enabled, screen lock with a short timeout, operating system within the patch window, and a managed browser or agent that can attest to the first three. Everything beyond that (specific antivirus products, certificate pinning, hardware tokens) is worth doing later and is not where the incidents come from.
The rollout order matters more than the checks. Start in observe mode: the Control Gateway records the posture of every device that connects and the Evidence Engine reports what would have been blocked. Share the report with the people affected before enforcing anything. At an industrial equipment maker the first report showed 30 percent of devices out of the patch window; two weeks and one reminder later it was 4 percent, with no enforcement yet.
Enforce gradually and by consequence, not by cliff. A device that drifts out of policy first loses access to design files and keeps everything else; a message explains which check failed and what to do. Most fixes are a restart. The help desk sees the hard cases only, which is what the help desk is for.
Personal devices deserve a decision, not a loophole. If plant engineers may use their own laptops, the same four checks apply through the managed browser, and the browser is the only path to design files. If they may not, the Control Gateway says so clearly instead of failing mysteriously. Either policy is fine; silence is not.
Record posture with every access decision. When the NIS2 auditor asks whether the device that exported a record in March was encrypted, the answer is in the Audit Vault, next to the identity and the approval, and nobody has to find the laptop.
Device posture is built into the Control Gateway. Talk to us about running the observe-mode report on your fleet.