6.3.2 For the purpose of point 6.3.1., the relevant entities shall: (a) lay down and ensure security in …

Requirement

For the purpose of point 6.3.1., the relevant entities shall: (a) lay down and ensure security in configurations for their hardware, software, services and networks; (b) lay down and implement processes and tools to enforce the laid down secure configurations for hardware, software, services and networks, for newly installed systems as well as for systems in operation over their lifetime.

Guidance

• Consider hardening guides/best practices and general cybersecurity principles (e.g. least functionality and least privilege) as a basis for deriving the defined security configurations.
• Establish, document and maintain configuration settings respecting the access control policy.
• Where applicable, test the configuration before implementation.
• Employ security safeguards to detect and respond to unauthorised changes to defined configuration settings.
• Establish a configuration management plan containing:
  • roles, responsibilities and configuration management processes and procedures;
  • a process for identifying CIs throughout the system development life cycle; and
  • a process for managing the configuration of the CIs throughout their life cycle.
• Protect the configuration management plan from unauthorised disclosure and modification.
• Implement enhanced controls, including regular vulnerability scanning, strict configuration hardening, isolation where feasible and continuous monitoring to compensate for products which lack official updates after the end of supplier support.

Examples of evidence

• Configuration management plan.
• Comparison of the configuration plan with the access control lists.
• Mechanisms, for example logical and physical access controls, encryption and audit logs in place.
• Documented and approved exceptions to the configuration baseline containing the alternative measures in place to ensure the confidentiality, availability and integrity of the CI.

1. Áttekintés

1.1 Hivatkozások

1.2 Azonosított követelmények

1.3 Kapcsolódó szabályozások

2. Azonosított követelmények

3. Kapcsolódó szabályozások

Kapcsolt feladatok

• ENISA -