Content library
C2M2: MIL1
ASSET-3: Manage IT and OT Asset Configuration

How to fill the requirement

C2M2: MIL1

ASSET-3: Manage IT and OT Asset Configuration

Task name
Priority
Status
Theme
Policy
Other requirements
Defining standard templates for secure configurations
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Network security
8
requirements

Task is fulfilling also these other security requirements

8.9: Configuration management
ISO27k1 Full
ASSET-3: Manage IT and OT Asset Configuration
C2M2: MIL1
CC7.1: Procedures for monitoring changes to configurations
SOC 2
1.2.4: Definition of responsibilities with service providers
TISAX
9.3 §: Tietojärjestelmien hankinta ja kehittäminen
KyberTL
1. Task description

Organization must be able to monitor that devices, data systems and networks are maintained in accordance with the defined configurations (including security features) both during the implementation phase and throughout their entire life cycle.

For this, the organization has defined standard templates for secure configurations of devices, data systems and networks. When specifying standard templates, the following are taken into account:

  • publicly available guidelines (e.g. templates from suppliers and independent security organizations)
  • the level of protection required for different assets
  • fulfilling related information security requirements
  • feasibility and applicability of the configurations to the organization's operations

Standard templates should be checked regularly and updated when significant new threats or vulnerabilities need to be responded to or new software or hardware versions are released.

The following points should be taken into account when defining standard templates:

  • the number of root-level rights is minimized
  • unnecessary access rights are disabled
  • unnecessary functions and services are deactivated
  • access to powerful utilities and important settings is strictly controlled
  • the clocks are synchronized
  • the supplier's default passwords are changed immediately and the security-related settings are checked
  • timeout functions are used if necessary (e.g. automatic logout)
  • license requirements are met
No items found.