6.3.1 The relevant entities shall take the appropriate measures to establish, document, implement and …

Requirement

The relevant entities shall take the appropriate measures to establish, document, implement and monitor configurations, including security configurations of hardware, software, services and networks.

Guidance

• Establish documented processes based on best practices and information security standards (52).
• Maintain and document detailed configuration settings for the following operating procedures (indicative, non-exhaustive list):
  • processing and handling of information,
  • backup,
  • scheduling requirements, including interdependencies with other systems,
  • handling errors or other exceptional conditions,
  • system restart and recovery procedures,
  • cryptographic mechanisms and settings, and
  • audit trail and system log information.
• Consider the following security-related parameters for the configuration settings (indicative, non-exhaustive list):
  • registry settings,
  • account, file and directory permission settings, and
  • settings for functions, ports, protocols, services and remote connections.
• Employ automated mechanisms to centrally manage, apply and verify configuration settings for software and hardware, including mobile devices and the entity’s connected vehicles.
  • Where appropriate, implement a configuration management database to catalogue and classify all configuration items (CIs), including their security attributes (e.g. patch level, firewall rules and encryption status)
• Ensure that all network, software and system configurations adhere to established security and operational standards for functions, ports, protocols and services.
• Monitor and control changes to the configuration settings in accordance with the entity’s policy on the security of network and information systems and topic-specific policies and procedures.
• Identify software not authorised to run on the information systems.
• Where appropriate, regularly review and update software configurations.
• Where appropriate, identify software programs authorised to run on the information system.
• Employ a deny-all, permit-by-exception policy to allow authorised software to run.
• Set up procedures for network service usage to restrict access to necessary services or applications only.
• Manage a secure baseline configuration for development and test environments separately from the operational baseline configuration, where appropriate.
• Identify, document and approve any deviations from established configuration settings based on defined exceptions on operational requirements.

Examples of evidence

• System configuration process, based on good practices and standards, in place and maintained.
• System configuration tables containing configurations of hardware, software, services and networks.
• Documented secure baseline configuration containing at least (indicative, non-exhaustive list):
  • essential capabilities of operation;
  • restricted use of functions;
  • security by default;
  • ports, protocols and/or services allowed.
• Documented and approved exceptions to the configuration baseline containing the alternative measures in place to ensure the confidentiality, availability and integrity of the CI.
• Documented secure baseline configuration for development and test environments.

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

Incidencias vinculadas

• ENISA -