Draft v0.1.05 of 6 frameworks
Secure configuration and hardening
Systems are built from hardened baselines, vendor defaults are changed and configuration drift is managed.
Where it appears
- SOC 2
CC7.1Uses detection and monitoring procedures to identify changes to configurations- PCI DSS 4.0
2.2System components are configured and managed securely- NIST CSF 2.0
PR.PS-01Configuration management practices are established and applied- ISO 27001:2022
A.8.9Configuration management- HIPAA Security Rule
- no direct requirement
- NIST 800-53 r5
CM-2Baseline configurationCM-6Configuration settingsCM-7Least functionality
No direct HIPAA Security Rule citation.
Evidence auditors usually ask for
A typical starting list. Your assessor's request list is the one that counts.
- Configuration standards or hardening baselines (e.g. CIS Benchmarks) per system type
- Evidence vendor default accounts and passwords were changed or disabled
- Configuration compliance scan results
- Exception records for deviations from baseline
Crosswalks that include this
SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0NIST CSF 2.0 to ISO 27001:2022NIST CSF 2.0 to NIST 800-53 r5