ASD Essentials IT.PRO-04.2 Deploy Approved Configuration Baselines to All Infrastructure, Operating Systems and Applications
What it says
Deploy approved configuration baselines on systems, including infrastructure, operating systems and applications.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPuts the approved secure settings on every system, including infrastructure, operating systems and applications, and confirms this with technical checks.
Approved secure settings only help once they are actually in place. To meet this, apply the right baseline (approved standard settings) to every system: network and cloud equipment, the operating systems on servers and staff computers, and their apps. Then use technical checks, such as a scan of each system's live settings, to confirm they took effect. Coverage figures show which systems have their baseline and which are still missing it.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
Why it matters
Default or insecure settings left on firewalls and remote access gateways give attackers an easy way in. On servers and laptops, they let harmful documents and scripts run. Rollouts nobody checks can leave the organisation wrongly believing it is protected.
How to implement
The configuration management lead and system owners should match every system type on the asset list to its approved baseline and version.
Record any type without one as a coverage gap.
Network, infrastructure and cloud teams should apply baselines to firewalls, remote access gateways, switches, virtual server hosts, storage and cloud settings.
Start with internet-facing devices, and use templates or automation, not hand-typed changes.
Server and desktop teams should build every server, admin computer, desktop and laptop from a locked-down standard build.
Enforce the same baseline on existing systems through central management, so users cannot override it.
Application owners should apply baselines to server apps, such as web, email and database servers.
Do the same for user apps, including browser, office, PDF, macro and command-line scripting settings, as one complete baseline.
The configuration assurance team should confirm each rollout with technical checks of the live settings, such as a compliance scan, not the deployment tool's status.
Report coverage by ASD domain and system type against the asset list.
Keep it running
The configuration management lead builds the baseline into every new build and change. Updates go out through central tools, not by hand. Check again whenever a baseline version changes or new systems arrive. Treat any system still without its baseline as a visible gap with an owner, not something quietly left out. Roll out in ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems, then business systems and staff devices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the register matching each system type to its approved baseline and version.
Look at
Whether system types such as firewalls, virtual server hosts or server apps have no baseline.
Good evidence
Every system type, from firewalls to server apps, has a current approved baseline.
- Check 2 of 5What an auditor asks for
Ask for
Ask to see live settings against the baseline on sampled systems in each ASD domain.
Look at
Whether sampled systems lack the baseline, run an older version, or have settings that differ.
Good evidence
Each sampled system has the current baseline in full, matching the coverage reports.
- Check 3 of 5What an auditor asks for
Ask for
Ask how new and rebuilt systems get their baseline, with recent build records.
Look at
Whether systems went live before their baseline was applied, or updates reached only some systems.
Good evidence
New systems go live with the baseline applied and checked, and updates reach every system.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the dated technical check results used to confirm the rollout.
Look at
Whether checks are missing, partial, out of date, or rely on the deployment tool's status.
Good evidence
Current results check the live settings on every applicable system against the latest baseline.
- Check 5 of 5What an auditor asks for
Ask for
Request coverage figures by ASD domain and system type, with the asset list they came from.
Look at
Whether figures are missing, don't match the asset list, or show patchy coverage.
Good evidence
Figures match the asset list and show every applicable system running its approved baseline.
ASD indicators of good practice (8)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(2)
- NE-1Approved baselines have not been applied to assets.
- NE-2Baseline deployment has not been validated through technical assessment.
Partially effective(3)
- PE-1Approved baselines have been implemented where available, but some relevant asset types are not covered by an approved baseline.
- PE-2Deployment has occurred but validation through technical assessment is incomplete or not current.
- PE-3Approved baselines have been deployed, but coverage for all applicable assets is inconsistent.
Fully effective(3)
- FE-1Approved baselines have been applied to all applicable assets.
- FE-2Deployment has been validated through technical assessment.
- FE-3Coverage metrics are available demonstrating deployment completeness.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration Management for Secure IT Systems, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.9.
IT.PRO-04.2 requires approved configuration baselines to be deployed on systems, including infrastructure, operating systems and applications. This is the implementation step of the configuration management required by Annex A 8.9. Annex A 8.9 is broader, also requiring configurations to be established, documented, monitored and reviewed.
This control partially overlaps A.8.20.
IT.PRO-04.2 requires approved configuration baselines to be deployed on systems, including infrastructure, operating systems and applications. Deploying approved baselines on network infrastructure helps secure network devices, which supports Annex A 8.20. Annex A 8.20 covers securing, managing and controlling networks more broadly, while IT.PRO-04.2 is limited to applying approved configurations.
ASD Essential Eight: 6 mappings
This control partially overlaps E8-AH-ML2.1.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; E8-AH-ML2.1 applies this to web browsers, requiring them to be hardened using ASD and vendor guidance, the most restrictive taking precedence.
This control partially overlaps E8-AH-ML2.6.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; E8-AH-ML2.6 applies this to office productivity suites, requiring them to be hardened using ASD and vendor guidance, the most restrictive taking precedence.
This control partially overlaps E8-AH-ML2.9.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; E8-AH-ML2.9 applies this to PDF software, requiring it to be hardened using ASD and vendor guidance, the most restrictive taking precedence.
This control partially overlaps E8-AH-ML3.3.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; E8-AH-ML3.3 requires PowerShell to be configured to use Constrained Language Mode, one specific configuration a deployed baseline would apply.
This control partially overlaps E8-RM-ML1.3.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; E8-RM-ML1.3 requires Microsoft Office macro antivirus scanning to be enabled, one specific application setting a deployed baseline would apply.
This control partially overlaps E8-RM-ML1.4.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; E8-RM-ML1.4 requires that Microsoft Office macro security settings cannot be changed by users, which keeps a deployed baseline's macro settings in place.
ASD Information Security Manual: 4 mappings
This control partially overlaps ISM-1246.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; ISM-1246 applies this to server applications, requiring them to be hardened using ASD and vendor guidance, the most restrictive taking precedence.
This control partially overlaps ISM-1409.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; ISM-1409 applies this to operating systems, requiring them to be hardened using ASD and vendor guidance, the most restrictive taking precedence.
This control partially overlaps ISM-1635.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; ISM-1635 requires system owners to implement security controls for each system and its operating environment, a broader duty that baselines help meet.
This control partially overlaps ISM-1914.
IT.PRO-04.2 requires approved configuration baselines to be deployed on infrastructure, operating systems and applications; ISM-1914 requires approved operating system configurations to be developed, implemented and maintained, covering the operating system part of it.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.