4.1
IG1 IG2 IG3

Establish and Maintain a Secure Configuration Process

Asset Type: Applications
Security Function: Protect

Description

Establish and maintain a secure configuration process for enterprise assets (end-user devices, including portable and mobile, non-computing/IoT devices, and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

Implementation Checklist

1
Assess current protection controls in place
2
Configure and deploy required security controls
3
Test control effectiveness in non-production environment
4
Deploy to production and verify functionality
5
Document configuration and operational procedures
6
Draft policy/procedure document
7
Obtain stakeholder review and approval
8
Communicate to affected personnel
9
Schedule periodic review and updates
10
Select hardening benchmark (CIS Benchmarks, DISA STIGs)
11
Create baseline configuration templates
12
Deploy configurations using automation tools
13
Schedule compliance scanning to detect drift

Threats & Vulnerabilities (CIS RAM)

Threat Scenarios

Exploitation of Default or Weak System Configurations

Integrity

Attackers exploit out-of-box default configurations including open ports, unnecessary services, and weak security settings that were never hardened according to a secure baseline.

Configuration Drift Enabling Attack Vectors

Confidentiality

Over time, systems drift from secure configurations through ad-hoc changes, reintroducing vulnerabilities that were previously mitigated and creating inconsistent security postures.

Ransomware Exploiting Unhardened Systems

Availability

Ransomware propagates rapidly through systems lacking hardened configurations, exploiting enabled-by-default protocols like SMBv1 and unnecessary remote access services.

Vulnerabilities (When Safeguard Absent)

No Defined Secure Configuration Baseline

Without a documented secure configuration process, systems are deployed with vendor defaults that prioritize ease of use over security, leaving known attack surfaces exposed.

No Configuration Review or Update Cadence

Without annual review of secure configuration standards, baselines become outdated as new attack techniques emerge and vendor recommendations change.

Evidence Requirements

Type Evidence Item Collection Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Configuration compliance scan results against approved baseline Scanned monthly
Document Approved baseline configuration documentation Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually