Sooner or later someone outside the business asks you to prove your devices are secure. It might be a client’s security questionnaire, a Cyber Essentials Plus assessor or an insurer. What they want is a current report from your DMS (formerly MDM) showing every Mac, iPhone and iPad against the security settings you’ve agreed, and someone who owns it.
Once you’re past about 50 devices, a spreadsheet won’t hold up, because it’s out of date as soon as it’s finished. The report needs to show whether each device meets those settings and when it last checked in, catch drift as it happens, and have one named owner who decides what counts as non-compliant and who sees it. Using that same status to control who can sign in is the next step, covered in device compliance and Microsoft 365 access, and the wider picture of growing an Apple estate is in Apple security at scale.
Why does a spreadsheet stop working as evidence?
It’s out of date the day it’s finished
A spreadsheet records what someone saw when they last checked. By the time a client reads it, a few Macs will have deferred an update, and someone will have a new iPhone that isn’t on the list. Evidence has to be true at the moment it’s asked for, and a manual audit can’t do that.
The devices that matter most are the ones nobody sees
A laptop that’s been offline for three weeks doesn’t show up in anyone’s memory, and it’s usually the one behind on updates. A spreadsheet can’t tell you a device has gone quiet. A DMS report can, because every device has a last check-in time next to it.
Around 50 devices, nobody can vouch for every machine
This is our rule of thumb, not an industry figure. Below about 50 devices, one person can usually tell you the state of each one from memory. Past that, they can’t, and in Dr Logic’s experience that’s roughly when the first client questionnaires start arriving too. The first draft of evidence we’re shown at that point is nearly always a spreadsheet built for the last audit.
What should a device compliance report show?
The baseline each device is checked against
Start with the settings every device must have. For most of our clients that means disk encryption, enforced OS updates, a password policy and the firewall configured and applied the same way across the fleet. If you hold or are working towards Cyber Essentials, its requirements are a sensible reference point, since that’s what an assessor will test against. Write the list down in plain language. A client should be able to read it without a glossary.
Each device’s status, with its last check-in
Every enrolled device, its OS version, whether it meets each required setting and when it last reported in. A device that’s compliant but hasn’t checked in for a fortnight is a question mark, and the report should make that obvious.
What happens when a device drifts
Settings applied through a DMS are enforced, so a Mac where someone has switched the firewall off gets it switched back on, and overdue updates install on the deadline you’ve set. Your report should show the drift and the fix, because a client will want to see that problems get caught and corrected automatically.
Every device, enrolled
All of this depends on device management already being in place, enrolled through Apple Business. A report only covers what’s enrolled, so the first number to check is how many devices you own against how many your DMS can see.
On the platform side, Addigy is our default and gives us real-time visibility across the fleet. For fleets with strict audit requirements or more complex needs, we sometimes recommend Jamf, and either way, the reporting is only as good as how it’s configured.
If you’re not sure your current setup could produce this today, we can set up the settings and reporting for you.
Who should own the report, and who sees it?
Define what non-compliant means
Decide the triggers in advance: an update pending past 14 days, encryption off, a device silent for more than a week. Fourteen days isn’t arbitrary, since it’s the Cyber Essentials window for critical and high-risk updates. Clear triggers stop every exception from becoming a judgement call.
Name one owner
One person, internal or your IT provider, who reviews the report on a fixed schedule and chases the exceptions. Monthly suits most agencies we support, with a quick look before any client or assessor deadline.
Decide the audience before anyone asks
Leadership gets a monthly summary. Clients get a version they can attach to a security questionnaire.
The ten-minute fleet check
Count your managed Apple devices. Note how many were last checked by a person and how many by a report. Then name who would produce compliance evidence if a client asked for it tomorrow. A count near 50 and a person’s name for that last answer means you’ve reached the point where the report needs to exist.
Related articles
- Apple security at scale: what changes after 50, 100 and 500 devices
- Device compliance, not just MFA, should decide who gets into Microsoft 365
- Mac security in regulated industries: how Lloyds Bank scaled 7,000+ devices
FAQs
What is device compliance for Apple devices?
It’s checking every Mac, iPhone and iPad against a set of required settings, such as encryption, OS updates, password policy and firewall, and keeping a record of which devices meet them. For a growing business, that record comes from device management, so it stays current without anyone checking machines by hand.
How often should we review a compliance report?
The DMS checks devices continuously, so the report is always current. A person should still review it on a schedule. Monthly suits most agencies we support, with an extra look before any client questionnaire, insurance renewal or Cyber Essentials Plus audit, so exceptions are fixed before anyone outside asks.
Is device compliance the same as conditional access?
They’re related. Compliance is knowing and proving each device meets your required settings. Conditional access uses that status to decide whether a device can sign in to services like Microsoft 365. You need compliance reporting first, and our conditional access article covers the second step.
Do we need Jamf for compliance reporting?
Usually not. Addigy is our default for Apple fleets of every size and gives real-time visibility of each device’s status. We recommend Jamf where a fleet has strict audit requirements or more complex needs, or where a business already runs it. We’ll tell you which fits during a discovery call.
