@raucao @quinn About the "not forced" thing, they kind of are.

'HAE-NCF-1: There should be a unified endpoint management (UEM) [48] solution in place to
manage and secure all endpoints...' from NIST SP 800-215

Not any specific brand or solution, but to be honest is there a big worst case scenario difference between Crowdstrike and its competitors? I'm oversimplifying but all of them require more or less a centralized management console with full admin access to endpoints.