Are unnecessary default accounts removed or Review policies and procedures disabled before installing a system on the Review vendor documentation network? Examine system configurations and account settings Interview personnel Are configuration standards developed for all 2.2 Review system configuration standards system components and are they consistent with Review industry-accepted hardening industry-accepted system hardening standards? standards Sources of industry-accepted system hardening Review policies and procedures standards may include, but are not limited to, Interview personnel SysAdmin Audit Network Security (SANS) Institute, National Institute of Standards Technology (NIST), International Organization for Standardization (ISO), and Center for Internet Security (CIS). Are system configuration standards updated as Review policies and procedures new vulnerability issues are identified, as defined Interview personnel in Requirement 6.1? Are system configuration standards applied when Review policies and procedures new systems are configured? Interview personnel
Are unnecessary default accounts removed or disabled before installing a system on the network? Review policies and procedures Review vendor documentation Examine system configurations and account settings Interview personnel 2.2 Are configuration standards developed for all system components and are they consistent with industry-accepted system hardening standards? Sources of industry-accepted system hardening standards may include, but are not limited to, SysAdmin Audit Network Security (SANS) Institute, National Institute of Standards Technology (NIST), International Organization for Standardization (ISO), and Center for Internet Security (CIS). Review system configuration standards Review industry-accepted hardening standards Review policies and procedures Interview personnel Are system configuration standards updated as new vulnerability issues are identified, as defined in Requirement 6.1? Review policies and procedures Interview personnel Are system configuration standards applied when new systems are configured? Review policies and procedures Interview personnel
SAQ_A-EP_v3.docx