Zero › Module 4 › Lesson 3
Compliance Signals
Device compliance hygiene — patch SLAs, stale enrollment, BYOD boundaries, certificate pinning literacy — hygiene checklist on YOUR $ZT_LAB.
Visual · t40_compliance_hygiene
Device compliance hygiene. $ZT_LAB. Original Cyberlium.
Opening
Stale MDM enrollment and unpatched OS silently erode ZT — hygiene checklist catches drift before auditors or incidents do.
Hygiene rows: patch SLA by device tier, re-enrollment on OS upgrade, remove stale devices quarterly, BYOD vs corp-owned policy literacy, certificate/trust store hygiene. Link non-compliant devices from M4 L1 matrix to remediation owner. Document hygiene checklist with review cadence — fictional dates. Next: Device Lab.
1. Hygiene rows (named)
Patch: critical within 14d literacy SLA on corp devices. Stale: no check-in 30d → retire device record. BYOD: app protection without full device trust.
Certificate: trusted CA list, no user-installed rogue roots on managed devices.
Command guide
Try these commands — Hygiene rows (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ZTMM Devices — https://www.cisa.gov/zero-trust-maturity-model NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_DEVICES=${ZT_DEVICES:-$ZT_LAB/LAB-ZT-001/devices}
cat > "$ZT_DEVICES/device-hygiene-checklist.md" <<'EOF'
# Device Hygiene Checklist — LAB-ZT-001
- [ ] Critical patch SLA 14d on corp devices (fictional)
- [ ] Stale MDM check-in 30d → retire device record
- [ ] BYOD: app protection without full device trust
- [ ] Re-enrollment on major OS upgrade
- [ ] Quarterly non-compliant device review
- [ ] EDR unhealthy → downgrade trust / block sensitive apps
- [ ] No user-installed rogue CA roots on managed devices
- [ ] Corp-owned lost device → remote wipe procedure stub
Owner: IT Ops + Security | Review: quarterly
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E '\[ \]|Stale|BYOD|LAB SAMPLE' "$ZT_DEVICES/device-hygiene-checklist.md"
python3 -c "print('Hygiene: stale enrollment row prevents ghost devices')"Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM Devices (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Remediation workflow
Non-compliant → notify user → grace period → block sensitive apps → wipe if corp-owned lost literacy sequence.
Owner: IT ops + security — fictional ticket IDs in lab.
3. Checklist ship
Ten checkbox rows with owner and cadence for LAB-ZT-001.
Ship: device hygiene checklist. Next: Device Lab.
4. What you ship: device hygiene checklist
Ten hygiene rows with owners and review cadence. $ZT_LAB fictional. chmod 600.
5. What you record before the next lesson
Date. Hygiene checklist. $ZT_LAB named. File t40-m04-l03-compliance-hygiene.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip stale device review because fleet is small in lab. Allow BYOD full VPN without app protection row.
Right
Write device hygiene checklist with stale enrollment row. Next: Device Lab.
Mission: device hygiene checklist
1) Write ten hygiene checkbox rows. 2) Assign fictional owner per row. 3) Set quarterly review date. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Stale enrollment row prevents ghost devices in CA trust.
Knowledge Check
APPLY: Device hygiene includes:
Multiple choice
Knowledge Check
APPLY: True or False: BYOD can use app protection without full device trust.
True or False
Knowledge Check
APPLY: Stale MDM devices should:
Multiple choice