PRO-04 Secure configuration management
3 actions under this Protect principle in Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Systems (infrastructure, operating systems and applications) are securely configured to approved and maintained baselines, including by reducing attack surfaces and attack paths, with configurations continually monitored and consistently enforced.
Quoted as published. Everything else on this page is written by Control Stack.
The three actions
- IT.PRO-04.1Define Approved Hardening Baselines Disabling Unneeded Services, Insecure Settings and Weak Protocols
Defines approved settings per system type that switch off unneeded services, risky options and weak protocols, based on vendor and industry advice.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.PRO-04.2Deploy Approved Configuration Baselines to All Infrastructure, Operating Systems and Applications
Puts the approved secure settings on every system, including infrastructure, operating systems and applications, and confirms this with technical checks.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.PRO-04.3Detect and Remediate Configuration Drift Using Scheduled Assessments and Automated Monitoring
Finds and fixes drift from approved settings with scheduled checks and, where supported, automated monitoring, checking critical or fast-changing systems more often.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices)
Back to the full ASD Essentials for enterprise IT action list, or browse the complete control library.