Endpoint Compliance
This domain tests how EMS evaluates endpoint posture and how that result drives access or remediation. Compliance is not the same as vulnerability scanning: compliance asks whether the endpoint meets a defined policy, while vulnerability management asks what weaknesses exist on the endpoint.
Compliance rules
- A compliance rule contains conditions such as OS version or build, antivirus running state, signature age, firewall status, disk encryption, patch level, FortiClient version, and vulnerability severity.
- Rules are evaluated on a schedule and at check-in. Results are typically compliant, noncompliant, or unknown. Unknown commonly means the endpoint has not checked in or the data is stale.
- Rule results can generate tags used by FortiGate or ZTNA policy. They can also trigger notifications and remediation actions.
- Multiple rules can apply to one endpoint. Check which rule produces the tag or status you are relying on, because a later rule does not automatically override an earlier one in every context.
Operational behavior
- Compliance rules should be assigned to the relevant groups. A rule that is not assigned to the endpoint’s group will not affect it.
- Remediation can include prompting the user, triggering a signature update or scan, or requiring the endpoint to check in again.
- Blocking or quarantining is usually enforced by FortiGate using the compliance tag, not by EMS alone. Confirm the FortiGate policy exists.
- Compliance status is only as current as the last check-in. An offline endpoint may show a stale compliant result.
Worked example
A rule requires Windows 11 23H2, antivirus enabled, and antivirus signatures no older than seven days. An endpoint has antivirus enabled but signatures are ten days old, so the rule produces noncompliant. FortiGate denies the endpoint’s VPN access through a tag-based policy. The user connects to the corporate network, EMS triggers a signature update, the endpoint checks in, and the next evaluation produces compliant. Reasoning: the failure is posture age, not identity, and remediation is an update plus re-evaluation.
Traps that cost marks
- Treating an offline endpoint as compliant because the last known result was compliant.
- Forgetting that a compliance rule must be assigned to the endpoint’s group.
- Confusing compliance status with vulnerability scan findings.
- Assuming EMS itself blocks traffic; check the FortiGate tag-based enforcement.
- Using a tag name that does not exactly match the FortiGate policy reference.