03.04.02 Configuration Settings

Statement

• a. Establish, document, and implement the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements: {{ insert: param, A.03.04.02.ODP.01 }} .

• b. Identify, document, and approve any deviations from established configuration settings.

Guidance

Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system and that affect the security posture or functionality of the system. Security-related configuration settings can be defined for systems (e.g., servers, workstations), input and output devices (e.g., scanners, copiers, printers), network components (e.g., firewalls, routers, gateways, voice and data switches, wireless access points, network appliances, sensors), operating systems, middleware, and applications. Security parameters are those parameters that impact the security state of the system, including the parameters required to satisfy other security requirements. Security parameters include registry settings; account, file, and directory permission settings (i.e., privileges); and settings for functions, ports, protocols, and remote connections. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for the system. The established settings become part of the system’s configuration baseline. Common secure configurations (also referred to as security configuration checklists, lockdown and hardening guides, security reference guides, and security technical implementation guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for specific information technology platforms/products and instructions for configuring those system components to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, consortia, academia, industry, federal agencies, and other organizations in the public and private sectors.

Assessment objective

the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements are established and documented: {{ insert: param, A.03.04.02.ODP.01 }}.

Assessment objective

any deviations from established configuration settings are identified and documented.

Assessment objective

any deviations from established configuration settings are approved.

Assessment objective

the following configuration settings for the system are implemented: {{ insert: param, A.03.04.02.ODP.01 }}.

Assessment method

• configuration management policy and procedures procedures for system configuration settings configuration management plan system design documentation system configuration settings common secure configuration checklists system component inventory evidence supporting approved deviations from established configuration settings change control records system data processing and retention permissions system audit records system security plan other relevant documents or records

Assessment method

• personnel with security configuration management responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for managing configuration settings mechanisms that implement, monitor, or control system configuration settings mechanisms that identify or document deviations from established configuration settings

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final