Are all enabled insecure services, daemons, or Review configuration standards protocols justified per documented configuration Interview personnel standards? Examine configuration settings Compare enabled services, etc. to documented justifications Are additional security features documented and Review configuration standards 2.2.3 implemented for any required services, protocols or Examine configuration settings daemons that are considered to be insecure? Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed. Are system administrators and/or personnel that Interview personnel 2.2.4 configure system components knowledgeable about common security parameter settings for those system components? Are common system security parameters settings Review system configuration included in the system configuration standards? standards Are security parameter settings set appropriately on Examine system components system components? Examine security parameter settings Compare settings to system configuration standards Has all unnecessary functionality—such as scripts, Examine security parameters on 2.2.5 drivers, features, subsystems, file systems, and system components unnecessary web servers—been removed? Are enabled functions documented and do they Review documentation support secure configuration? Examine security parameters on system components Is only documented functionality present on system Review documentation components? Examine security parameters on system components
Are all enabled insecure services, daemons, or protocols justified per documented configuration standards? Review configuration standards Interview personnel Examine configuration settings Compare enabled services, etc. to documented justifications 2.2.3 Are additional security features documented and implemented for any required services, protocols or daemons that are considered to be insecure? Note: Where SSL/early TLS is used, the requirements in Appendix A2 must be completed. Review configuration standards Examine configuration settings 2.2.4 Are system administrators and/or personnel that configure system components knowledgeable about common security parameter settings for those system components? Interview personnel Are common system security parameters settings included in the system configuration standards? Review system configuration standards Are security parameter settings set appropriately on system components? Examine system components Examine security parameter settings Compare settings to system configuration standards 2.2.5 Has all unnecessary functionality—such as scripts, drivers, features, subsystems, file systems, and unnecessary web servers—been removed? Examine security parameters on system components Are enabled functions documented and do they support secure configuration? Review documentation Examine security parameters on system components Is only documented functionality present on system components? Review documentation Examine security parameters on system components