Key takeaways
- Define, document and control secure configurations of systems.
- Default or inconsistent configurations leave gaps attackers know how to find.
- Start here: define secure baseline configurations for systems and cloud services.
Purpose
Define, document and control secure configurations of systems.
Requirement
Requirement summaryConfigurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed.
Why it matters
Default or inconsistent configurations leave gaps attackers know how to find.
How to implement
- Define secure baseline configurations for systems and cloud services.
- Apply them using automation or templates.
- Detect drift from baselines.
- Review baselines after major changes.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.9. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your standard secure settings (baselines) for key systems.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.9 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Records showing systems are built using the baselines.
- Reports showing settings haven't drifted.
- Change records for any setting changes.
Things you should be able to show or explain
- Be able to compare one system against its baseline.
How much to show: Three to five systems.
Common mistakes
- No baselines written down.
- Default passwords still in use.
- Default passwords left on devices.
- Cloud storage buckets left public.
- Tip: Use hardened baselines such as CIS Benchmarks.
Policies & documents to have
- Operations Security Policy
FAQ
Is A.8.9 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.9?
Be ready to explain how the control works in your organisation and to provide things like: Your standard secure settings (baselines) for key systems…