|
|
Configuration management guidelines are as follows:
- Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the system development life cycle.
- Establish and enforce security configuration settings for IT products employed in organizational systems.
- Track, review, approve/disapprove, and audit changes to organizational systems.
- Analyze the security impact of changes prior to implementation.
- Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
- Employ the principle of least privilege by configuring organizational systems to provide only essential capabilities.
- Restrict, disable, and prevent the use of nonessential functions, ports, protocols, and services.
- Apply deny-by-exception (block) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (allow) policy to allow the execution of authorized software.
- Control and monitor user-installed software.
|
|
