An administrator must deploy an endpoint posture policy for all users.

Cisco Identity Services Engine (ISE) is the central policy engine for posture assessments. As outlined in the SCAZT guide (Section 2: User and Device Security, Pages 39–44), to implement posture assessment and client provisioning correctly, an administrator must create posture policies within Cisco ISE and configure the Network Access Device (NAD)—such as a switch, WLC, or firewall—for redirection. This redirection sends the user to the posture portal, where ISE verifies the Secure Client modules (such as AnyConnect) and enforces compliance with antivirus signatures and OS updates.

ISE evaluates endpoint health based on pre-defined compliance rules and supports automatic remediation via the client provisioning portal. This ensures consistency and policy enforcement across distributed environments.