PR.PS Platform Security

Statement

Configuration management practices are established and applied

Guidance

Establish, test, deploy, and maintain hardened baselines that enforce the organization's cybersecurity policies and provide only essential capabilities (i.e., principle of least functionality)

Guidance

Review all default configuration settings that may potentially impact cybersecurity when installing or upgrading software

Guidance

Monitor implemented software for deviations from approved baselines

Statement

Software is maintained, replaced, and removed commensurate with risk

Guidance

Perform routine and emergency patching within the timeframes specified in the vulnerability management plan

Guidance

Update container images, and deploy new container instances to replace rather than update existing instances

Guidance

Replace end-of-life software and service versions with supported, maintained versions

Guidance

Uninstall and remove unauthorized software and services that pose undue risks

Guidance

Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse

Guidance

Define and implement plans for software and service end-of-life maintenance support and obsolescence

Statement

Hardware is maintained, replaced, and removed commensurate with risk

Guidance

Replace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities

Guidance

Define and implement plans for hardware end-of-life maintenance support and obsolescence

Guidance

Perform hardware disposal in a secure, responsible, and auditable manner

Statement

Log records are generated and made available for continuous monitoring

Guidance

Configure all operating systems, applications, and services (including cloud-based services) to generate log records

Guidance

Configure log generators to securely share their logs with the organization's logging infrastructure systems and services

Guidance

Configure log generators to record the data needed by zero-trust architectures

Statement

Installation and execution of unauthorized software are prevented

Guidance

When risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorized software

Guidance

Verify the source of new software and the software's integrity before installing it

Guidance

Configure platforms to use only approved DNS services that block access to known malicious domains

Guidance

Configure platforms to allow the installation of organization-approved software only

Statement

Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

Guidance

Protect all components of organization-developed software from tampering and unauthorized access

Guidance

Secure all software produced by the organization, with minimal vulnerabilities in their releases

Guidance

Maintain the software used in production environments, and securely dispose of software once it is no longer needed