PW.9 Configure Software to Have Secure Settings by Default

Statement

Define a secure baseline by determining how to configure each setting that has an effect on security or a security-related setting so that the default settings are secure and do not weaken the security functions provided by the platform, network infrastructure, or services.

Example 1:

Conduct testing to ensure that the settings, including the default settings, are working as expected and are not inadvertently causing any security weaknesses, operational issues, or other problems.

Statement

Implement the default settings (or groups of default settings, if applicable), and document each setting for software administrators.

Example 1:

Verify that the approved configuration is in place for the software.

Example 2:

Document each setting’s purpose, options, default value, security relevance, potential operational impact, and relationships with other settings.

Example 3:

Use authoritative programmatic technical mechanisms to record how each setting can be implemented and assessed by software administrators.

Example 4:

Store the default configuration in a usable format and follow change control practices for modifying it (e.g., configuration-as-code).