http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_eps.html
EPS:
Endpoint Protection Services (EPS) is a service that runs on the Cisco Identity Services Engine Administration node to extend the monitoring and controlling of endpoints. You can use EPS to monitor and change the authorization state of an endpoint without having to modify the overall Authorization Policy of the system. EPS supports both wired and wireless deployments.
Blacklist :
The Cisco ISE administrator can now "blacklist" wireless user devices that get "lost," or otherwise become unusable or are taken out of circulation, until the device is reinstated or is completely removed from the network. Cisco ISE removes "blacklisted" devices from the network, and they are not allowed on the network again until the device is reinstated. In order to set up the authorization policy in Cisco ISE, you also must ensure you add a compatible dynamic ACL on any associated network access devices in your deployment to manage these wireless users.
