How to Answer Device Management and MDM Questions
Your customer asked: “Do you centrally manage company devices or use MDM?”
The short answer
Mobile device management (MDM) or another endpoint-management platform can enforce settings on enrolled devices, but having the tool is not the same as managing every device. Verify which devices and users are actually in scope.
Educational guidance only. This page does not determine what is true about your company and does not create a security, compliance, testing, or certification claim.
What the customer is really asking
Understand the question before you answer it.
The customer may be trying to understand whether your company can enforce device settings such as passcodes, encryption, software updates, screen lock, remote actions, or security tooling. The exact capabilities depend on your platform and configuration.
How to answer accurately
Start with the version that matches reality.
If devices are centrally managed
Describe the enrolled device scope and the high-level settings you can verify. Avoid listing controls that are available in the product but not configured by your company.
If only company-owned devices are managed
Say that. Do not extend the claim to personal or contractor devices unless they are also enrolled.
If no MDM is used
Answer accurately and describe any separate device practices only if they are relevant to the question.
A useful answer structure
Status → scope → current practice → supporting information. Start with the direct answer, narrow it to what you can verify, explain how the practice works, and reference evidence only when that evidence actually exists.
Evidence that may help
These are examples, not requirements and not proof that your company has the practice. Use only evidence that really exists and is appropriate to share.
- MDM or endpoint-management enrollment list
- Configuration profile
- Compliance status dashboard
- Device inventory
What not to say
- That every device is managed because the company owns an MDM subscription.
- That a setting is enforced because the MDM product supports it.
- That device management proves employee compliance outside the enrolled scope.
How Oredra handles this
Answer it once. Keep the truth behind the answer.
Oredra is designed to distinguish available tool capability from an implemented company configuration—a critical difference in device-management answers.
Inside Oredra, a written policy, stated company practice, implemented control, available evidence, tested control, and independent certification remain distinct. Oredra uses approved information to draft future answers and flags questions that the approved profile cannot support.
Authoritative references
Oredra uses primary guidance where a technical or assurance concept benefits from verification. These references do not determine your company's answer.
Related questionnaire questions
Do employees receive security awareness training?
Answer based on training your workforce actually receives. A security policy, onboarding conversation, or occasional reminder may be useful, but it should not be described as a recurring formal training program unless that is what your company operates.
Do you conduct phishing simulations?
A phishing simulation is a controlled exercise that sends simulated phishing messages to evaluate or reinforce employee behavior. General awareness training and real phishing attempts do not automatically count as simulations.
Do you use endpoint protection or anti-malware?
The reviewer is asking what protects laptops, desktops, servers, or other endpoints from malicious activity. A product license is not proof that every relevant endpoint is enrolled, active, monitored, or configured consistently.