Secure Configuration
What is Secure Configuration?
The process of implementing security settings and hardening measures on systems and devices according to established security baselines and benchmarks.
Terms that appear alongside secure configuration
Each of these is named in at least one of the same controls as secure configuration. The number is how many controls name both.
- hardening 13 shared controls
- cybersecurity 11 shared controls
- baseline 9 shared controls
- integrity 7 shared controls
- access control 7 shared controls
- vulnerability 6 shared controls
- network segmentation 6 shared controls
- cis benchmarks 6 shared controls
Frameworks that govern secure configuration
What the standards actually require on secure configuration
Requirements naming secure configuration across 6 standards, quoted from the control text.
Establish secure configuration settings that reflect the most restrictive mode consistent with operational requirements.
SP800-128-SECURE-CONFIG · Secure Configurations of Information Systems →Use Azure Policy and Defender for Cloud secure score to audit and enforce configuration baselines across subscriptions.
PV-2 · Audit and enforce secure configurations →Secure software configurations are required when deploying both procured and in-house software, with settings checked against the asset's security requirements.
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-4c · ARCHITECTURE-4c: Secure configuration required at software deployment →Set up and keep a process for configuring network devices securely. Revisit the documentation each year, or sooner when a major change in the enterprise could affect this Safeguard.
CIS-4.2 · Establish and Maintain a Secure Configuration Process for Network Infrastructure →Keep a written secure configuration process specific to network devices, reviewed yearly or after significant change. Implementation Groups: IG1, IG2 and IG3 (part of the IG1 essential cyber hygiene baseline, so every enterprise applies it).
cis-controls-v8-1::4.2 · Establish and Maintain a Secure Configuration Process for Network Infrastructure →Before going live equipment is configured to remove default accounts and passwords, apply minimum functionality (remove unneeded functions) and security by default (secure natural use, conscious acts to lower security), with virtual machines and hosts managed...
spain-ens::op.exp.2 · Secure configuration before operation →Questions people ask about secure configuration
What is Secure Configuration?
Why is Secure Configuration important for compliance?
Which compliance frameworks address Secure Configuration?
Where can I learn more about Secure Configuration?
See how Secure Configuration applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.