Are security-related wireless vendor defaults Review policies and procedures changed, if applicable? Review vendor documentation Examine system configurations [Should be N/A unless cellular wireless. Wireless connection of OSU’s SAQ C devices is not allowed, with the exception of cellular wireless. If your non-cellular device is connected wirelessly, please work with your IT department to change this connection. For cellular wireless, fill out per your OST-approved 3rd party vendor.] Are configuration standards developed for all 2.2 Review system configuration standards system components and are they consistent with Review industry-accepted hardening industry-accepted system hardening standards? standards Sources of industry-accepted system hardening Review policies and procedures standards may include, but are not limited to, Interview personnel SysAdmin Audit Network Security (SANS) Institute, [Fill out per your OST-approved 3rd party National Institute of Standards Technology (NIST), vendor.] International Organization for Standardization (ISO), and Center for Internet Security (CIS). Are system configuration standards updated as Review policies and procedures new vulnerability issues are identified, as defined Interview personnel in Requirement 6.1? [Fill out per your OST-approved 3rd party vendor.] Are system configuration standards applied Review policies and procedures when new systems are configured? Interview personnel [Fill out per your OST-approved 3rd party vendor.]
Are security-related wireless vendor defaults changed, if applicable? Review policies and procedures Review vendor documentation Examine system configurations [Should be N/A unless cellular wireless. Wireless connection of OSU’s SAQ C devices is not allowed, with the exception of cellular wireless. If your non-cellular device is connected wirelessly, please work with your IT department to change this connection. For cellular wireless, fill out per your OST-approved 3rd party vendor.] 2.2 Are configuration standards developed for all system components and are they consistent with industry-accepted system hardening standards? Sources of industry-accepted system hardening standards may include, but are not limited to, SysAdmin Audit Network Security (SANS) Institute, National Institute of Standards Technology (NIST), International Organization for Standardization (ISO), and Center for Internet Security (CIS). Review system configuration standards Review industry-accepted hardening standards Review policies and procedures Interview personnel [Fill out per your OST-approved 3rd party vendor.] Are system configuration standards updated as new vulnerability issues are identified, as defined in Requirement 6.1? Review policies and procedures Interview personnel [Fill out per your OST-approved 3rd party vendor.] Are system configuration standards applied when new systems are configured? Review policies and procedures Interview personnel [Fill out per your OST-approved 3rd party vendor.]
saq_c_v3_1_instr.docx