One-to-one computing is a device deployment model where each person is assigned their own dedicated computer or tablet. It is used in schools and workplaces to give users a personal endpoint with separate accounts, settings and storage, while administrators manage enrolment, patching, encryption and device controls centrally.
How one-to-one computing works
One-to-one computing is a deployment model, not a security control by itself. The core idea is that each user has a personal endpoint with a defined owner, so account usage, local storage, settings and software state can be tied to an individual rather than shared across a pool of devices.
That ownership model changes how endpoint security is administered. A school or workplace can standardise enrolment, patching, encryption and policy enforcement centrally, while still allowing the device to behave like a personal computer for the assigned user.
Why one-to-one computing is used
Organisations adopt one-to-one computing when they want consistent access to digital tools without the friction of shared terminals or lab devices. The model supports continuity, because a person can return to the same device, same workspace and same local context across sessions.
It also gives administrators more predictable control over the fleet. When each endpoint has a clear user relationship, it is easier to apply baseline configuration, track compliance, separate user data and support remote actions such as lock, wipe or recovery when a device is lost or stolen.
Security implications of personal endpoints
A one-to-one model changes the security boundary from the shared room or classroom to the individual device. That can improve accountability, but it also means the organisation is depending on many distributed endpoints that may leave the building, connect to untrusted networks and store sensitive data locally.
Because each device is a user-facing endpoint, the organisation must treat device posture, patch level, encryption state and local access controls as part of the security baseline. The model is strongest when central management is reliable enough to keep the device estate consistent even though the devices are physically and operationally dispersed.
Common operational trade-offs
One-to-one computing can reduce sharing-related friction, but it increases the volume of assets to enrol, maintain and recover. It can also create a false sense of security if the device is personally assigned but not tightly managed, because personal ownership does not automatically mean strong endpoint protection.
For practitioners, the main trade-off is convenience versus control. The model works best when device identity, user access, encryption, update enforcement and offboarding are treated as a single lifecycle, not as separate administration tasks.
Risk and Threat Considerations
One-to-one computing increases the security impact of a single lost, stolen or compromised endpoint because the device often contains active sessions, cached data, local files and user-specific access paths. It also expands exposure when many personally assigned devices operate outside a controlled network perimeter.
Failure mechanism: If patching, encryption or device control is inconsistent, an exposed endpoint can become the easiest path to local data disclosure, account abuse or persistence through stored credentials and signed-in sessions.
Impact: The result can be unauthorised access to school or corporate resources, loss of local or synchronised data, and wider exposure if the compromised device is trusted by other systems or services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | One-to-one computing depends on accountable user access to personally assigned endpoints. |
| AC-19 — Access Control for Mobile Devices | Personally assigned tablets and laptops need explicit control when they move offsite. | |
| CM-8 — System Component Inventory | Device fleets need accurate inventory to track each assigned endpoint through its lifecycle. | |
| Recommendation — Enforce strong user authentication on each assigned device and bind access to the individual user. Apply mobile device access controls to manage use, storage and trusted connections on personal endpoints. Maintain an accurate inventory of every assigned device so ownership, status and compliance stay visible. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | One-to-one fleets rely on consistent hardened configurations across many managed endpoints. |
| CIS-7 — Continuous Vulnerability Management | Regular patching is central to keeping individually assigned devices trusted and supportable. | |
| Recommendation — Standardise secure configurations for all assigned endpoints and verify they remain enforced. Continuously scan and remediate vulnerabilities on every assigned device to keep the fleet current. | ||
| NIST CSF 2.0 | PR.AA-05 — Managed Access Permissions | The model requires controlled access rights and recovery actions for each user-owned endpoint. |
| Recommendation — Manage endpoint access permissions so device use, recovery and remote actions stay governed. | ||
Practitioner Guidance
Why practitioners should care: The value of one-to-one computing depends on central discipline, not just device assignment. If onboarding, policy enforcement and recovery are weak, the model becomes a large-scale endpoint management problem rather than a controlled personal-computing programme.
What to watch for: Pay attention to unmanaged devices, delayed patch compliance, weak local protection and inconsistent offboarding. Those are the signs that the deployment model is drifting away from the control assumptions that make it safe.
Related resources from NHI Mgmt Group
- What is the difference between a secure identity base and an insecure one when planning for autonomous computing?
- When do NHI access reviews create more value than a one-time cleanup?
- How should security teams govern AI platform access from day one?
- Should organisations consolidate secret management and privileged access into one platform?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org