[MexicanJoe]

We use unrestricted Mac's at my company, heck many use their own laptop. But we have very restrict access rules for sensitive information. The majority does not have access to company or user sensitive information. We are trying to strike a good balance between security and just letting people do their job.

[eastbound]

How do you ensure that laptops that access user-sensitive information don’t have a virus?

Is it a solution to require to use a VM with no sudo, so PII is accessed from a machine with no sudo and proper audit trail?