INF-002 Configuration Baseline and Hardening
Description
All production systems, including operating systems, hypervisors, containers and cloud services, are deployed against a documented hardening baseline. The baseline disables unused ports, protocols, services and accounts, and for cloud services it also fixes identity, access, network, encryption and logging settings. A defined number of previous versions of each baseline is retained, so a system can be returned to an earlier known-good configuration. Deviations from the baseline are detected automatically and reviewed.
Rationale
Default-insecure configurations expand the attack surface, and a verified baseline puts systems into a known minimal-privilege state from the first deployment. Drift detection reports that the live estate no longer matches the baseline, and without the prior version there is nothing to return it to. Retaining versions makes a bad baseline change recoverable. Restrictions on which software may run are INF-009's rather than this control's.
Applicability (9 profiles)
The deployer's own systems. For the hosted tier the provider's baseline is inherited and evidenced under VND-004.
The deployer's own systems. For the hosted tier the provider's baseline is inherited and evidenced under VND-004.
Framework Mappings (28)
| CCC-04 | Unauthorized Change Protection | informative |
| CCC-06 | Change Management Baseline | full |
| CCC-07 | Detection of Baseline Deviation | full |
| I&S-01 | Infrastructure and Virtualization Security Policy and Procedures | partial |
| I&S-04 | OS Hardening and Base Controls | full |
| CCC-04 | Unauthorized Change Protection | informative |
| CCC-06 | Change Management Baseline | full |
| CCC-07 | Detection of Baseline Deviation | full |
| I&S-01 | Infrastructure and Virtualization Security Policy and Procedures | partial |
| I&S-04 | OS Hardening and Base Controls | full |
| 8.9 | Configuration management | full |
| AML.M0011 | Restrict Library Loading | informative |
| NIS2-CIR-6.3 | Configuration Management | partial |
| CM-1 | Policy and Procedures | partial |
| CM-2 | Baseline Configuration | full |
| CM-2(2) | Baseline Configuration | Automation Support for Accuracy and Currency | full |
| CM-2(3) | Baseline Configuration | Retention of Previous Configurations | full |
| CM-6 | Configuration Settings | full |
| CM-6(1) | Configuration Settings | Automated Management, Application, and Verification | full |
| CM-7 | Least Functionality | partial |
| CM-7(1) | Least Functionality | Periodic Review | full |
| CM-9 | Configuration Management Plan | partial |
| PL-9 | Central Management | informative |
| SC-34 | Non-modifiable Executable Programs | informative |
| SI-14 | Non-persistence | informative |
| SI-4(22) | System Monitoring | Unauthorized Network Services | full |
| CC6.1 | Logical Access Security Software, Infrastructure, and Architectures | informative |
| CC7.1 | Detection and Monitoring Procedures | partial |
Evidence (3)
Hardening baseline configuration applied to production systems, showing disabled services, ports, protocols, and default accounts in line with a published benchmark.
Example: CIS Benchmark compliance scan output (e.g., AWS Inspector, Lynis report, or InSpec profile run) for a representative sample of production servers, containers, or cloud services
Test: Run a hardening compliance scan against a representative sample of production workloads of each type in use. Verify: (1) a baseline document exists for each workload type and names the benchmark it derives from, (2) the baseline states the pass threshold and the exceptions permitted against it, (3) unused ports, protocols, services and default accounts are disabled on every sampled workload, (4) the scan result for each sampled workload meets the threshold the baseline states, (5) every deviation is either an exception recorded in the baseline with an owner and an expiry date, or an open remediation item.
Configuration drift detection alert history showing automated detection and assignment of deviations from the hardening baseline.
Example: AWS Config Rules non-compliance events, GCP SCC findings, or equivalent CSPM tool alert log for the preceding 90 days
Test: Query the CSPM or configuration compliance tool for baseline deviation alerts in the last 90 days. Verify: (1) alerting is enabled and actively firing for baseline deviations; (2) each alert has a documented review or remediation action; (3) mean time to remediation is within the organisation's defined SLA by severity.
Version history of the hardening baseline showing the retained previous versions and the repository setting that keeps them.
Example: Baseline repository history, cis-l1-linux baseline, retention policy export 2026-08
Test: Request the baseline version history and the retention setting. Verify: (1) the number of retained previous versions meets or exceeds the number the baseline document sets, (2) each retained version resolves to a complete baseline rather than a change summary, (3) a rollback to the immediately previous version was exercised or tested during the period, (4) retention is enforced by the repository configuration rather than by convention, (5) the retained versions cover every baseline in use, not only the most actively edited one.
Questions (3)
Are all production systems deployed against a documented hardening baseline?
The baseline should reference a named benchmark (e.g. CIS Level 1/2, DISA STIG) and apply to all production workload types, not just servers.
Which approach is used to enforce the hardening baseline and detect deviations?
Automated enforcement at build time combined with runtime drift detection provides the strongest assurance. Periodic scans are a minimum acceptable approach.
Are previous versions of each hardening baseline retained so a system can be returned to an earlier known-good configuration?
Answer yes only where a defined number of complete prior versions is kept and retention is enforced by the repository rather than left to convention. Drift detection tells you the estate no longer matches the baseline; without the prior version there is nothing to return it to.