// Level 3 · Controls

Configuration Management

Establish and maintain baseline configurations.

Establish and maintain baseline configurations and inventories of organizational systems.

Establish and enforce security configuration settings for IT products.

Track, review, approve/disapprove, and log changes to organizational systems.

Analyze the security impact of changes prior to implementation.

Define, document, approve, and enforce physical and logical access restrictions.

Employ the principle of least functionality by configuring systems to provide only essential capabilities.

Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.

Apply deny-by-exception (blacklist) or permit-by-exception (whitelist) policies for software execution.

Control and monitor user-installed software.