If virtualization technologies are used, is only Examine system configurations one primary function implemented per virtual system component or device? Are only necessary services, protocols, 2.2.2 Review configuration standards daemons, etc. enabled as required for the Examine system configurations function of the system (services and protocols not directly needed to perform the device’s specified function are disabled)? Are all enabled insecure services, daemons, or Review configuration standards protocols justified per documented configuration Interview personnel standards? Examine configuration settings Compare enabled services, etc. to documented justifications Are additional security features documented and Review configuration standards 2.2.3 implemented for any required services, protocols or Examine configuration settings daemons that are considered to be insecure? Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed. Are system administrators and/or personnel that 2.2.4 Interview personnel configure system components knowledgeable about common security parameter settings for those system components? Are common system security parameters Review system configuration standards settings included in the system configuration standards? Are security parameter settings set appropriately Examine system components on system components? Examine security parameter settings Compare settings to system configuration standards
If virtualization technologies are used, is only one primary function implemented per virtual system component or device? Examine system configurations 2.2.2 Are only necessary services, protocols, daemons, etc. enabled as required for the function of the system (services and protocols not directly needed to perform the device’s specified function are disabled)? Review configuration standards Examine system configurations Are all enabled insecure services, daemons, or protocols justified per documented configuration standards? Review configuration standards Interview personnel Examine configuration settings Compare enabled services, etc. to documented justifications 2.2.3 Are additional security features documented and implemented for any required services, protocols or daemons that are considered to be insecure? Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed. Review configuration standards Examine configuration settings 2.2.4 Are system administrators and/or personnel that configure system components knowledgeable about common security parameter settings for those system components? Interview personnel Are common system security parameters settings included in the system configuration standards? Review system configuration standards Are security parameter settings set appropriately on system components? Examine system components Examine security parameter settings Compare settings to system configuration standards