Skip to main content

CFG-04: Secure Baseline Configurations

CFG 10 — Critical Protect

Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.

Renumbered: Formerly CFG-02 in SCF 2025.4.

Code reused: In SCF 2025.4 and earlier, CFG-04 was Software Usage Restrictions. That control is now CFG-11.

Control Question: Does the organization develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted system hardening standards?

General (63)
Framework Mapping Values
AICPA TSC 2017:2022 (used for SOC 2) (source) CC6.1-POF7 CC6.7-POF1 CC7.1 CC7.1-POF1 CC8.1 CC8.1-POF6 CC8.1-POF12
CIS CSC 8.1 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.10 10.3 10.4 10.5 16.7
CIS CSC 8.1 IG1 4.1 4.2 4.3 4.4 4.5 4.6 4.7 10.3
CIS CSC 8.1 IG2 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.10 10.3 10.4 10.5 16.7
CIS CSC 8.1 IG3 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.10 10.3 10.4 10.5 16.7
COBIT 2019 BAI10.02
CSA CCM 4.1.0 AIS-02 CCC-06 I&S-04 UEM-07
CSA IoT SCF 2 CLS-05 IOT-02 IOT-03 IOT-07 SNT-01 SWS-01 SWS-08
GovRAMP CM-02 CM-06 SA-08
GovRAMP Core CM-02 CM-06
GovRAMP Low CM-02 CM-06
GovRAMP Low+ CM-02 CM-06
GovRAMP Moderate CM-02 CM-06 SA-08
GovRAMP High CM-02 CM-06 SA-08
IEC 62443-2-1 2024 CM 1.3 NET 2.1(a) NET 2.1(c) NET 2.3 NET 3.3 COMP 1.1 USER 1.7 USER 1.8
IEC 62443-3-3 2013 SR 2.2 SR 7.6
IEC 62443-4-2 2019 CR 2.2 CR 7.6
IEC TR 60601-4-5 2021 4.2 5.1
IMO Maritime Cyber Risk Management 3.5.3.2 3.5.3.3 3.5.3.4 3.5.3.5
ISO 27002 2022 8.3 8.5 8.9 8.12 8.25 8.26
ISO 27017 2015 9.4.1 9.4.2 14.1.1
ISO 27018 2025 8.5 8.9 8.12 8.25 8.26
MITRE ATT&CK 16 T1001 T1001.001 T1001.002 T1001.003 T1003 T1003.001 T1003.002 T1003.003 T1003.004 T1003.005 T1003.006 T1003.007 T1003.008 T1008 T1011 T1011.001 T1020.001 T1021 T1021.001 T1021.002 T1021.003 T1021.004 T1021.005 T1021.006 T1021.008 T1027 T1027.010 T1029 T1030 T1036 T1036.001 T1036.003 T1036.005 T1036.007 T1036.010 T1037 T1037.002 T1037.003 T1037.004 T1037.005 T1046 T1047 T1048 T1048.001 T1048.002 T1048.003 T1052 T1052.001 T1053 T1053.002 T1053.003 T1053.005 T1053.006 T1055 T1055.008 T1056.003 T1059 T1059.001 T1059.002 T1059.003 T1059.004 T1059.005 T1059.006 T1059.007 T1059.008 T1059.010 T1059.011 T1068 T1070 T1070.001 T1070.002 T1070.003 T1070.007 T1070.008 T1070.009 T1071 T1071.001 T1071.002 T1071.003 T1071.004 T1072 T1078 T1078.002 T1078.003 T1078.004 T1080 T1087 T1087.001 T1087.002 T1090 T1090.001 T1090.002 T1090.003 T1091 T1092 T1095 T1098 T1098.001 T1098.002 T1098.003 T1098.004 T1098.005 T1098.007 T1102 T1102.001 T1102.002 T1102.003 T1104 T1105 T1106 T1110 T1110.001 T1110.002 T1110.003 T1110.004 T1111 T1114 T1114.002 T1114.003 T1119 T1127 T1127.001 T1127.002 T1129 T1132 T1132.001 T1132.002 T1133 T1134 T1134.001 T1134.002 T1134.003 T1134.005 T1135 T1136 T1136.001 T1136.002 T1136.003 T1137 T1137.001 T1137.002 T1137.003 T1137.004 T1137.005 T1137.006 T1176 T1185 T1187 T1189 T1190 T1195 T1195.001 T1195.003 T1197 T1199 T1201 T1204 T1204.001 T1204.002 T1204.003 T1205 T1205.001 T1210 T1211 T1212 T1213 T1213.001 T1213.002 T1213.004 T1213.005 T1216 T1216.001 T1216.002 T1218 T1218.001 T1218.002 T1218.003 T1218.004 T1218.005 T1218.007 T1218.008 T1218.009 T1218.012 T1218.013 T1218.014 T1218.015 T1219 T1220 T1221 T1222 T1222.001 T1222.002 T1482 T1484 T1485 T1486 T1489 T1490 T1491 T1491.001 T1491.002 T1495 T1498 T1498.001 T1498.002 T1499 T1499.001 T1499.002 T1499.003 T1499.004 T1505 T1505.001 T1505.002 T1505.003 T1505.004 T1505.005 T1525 T1528 T1530 T1537 T1539 T1542 T1542.001 T1542.003 T1542.004 T1542.005 T1543 T1543.001 T1543.002 T1543.003 T1543.004 T1546 T1546.002 T1546.003 T1546.004 T1546.006 T1546.008 T1546.010 T1546.013 T1546.014 T1546.016 T1547.002 T1547.003 T1547.005 T1547.006 T1547.007 T1547.008 T1547.009 T1547.013 T1548 T1548.001 T1548.002 T1548.003 T1548.004 T1548.006 T1550 T1550.001 T1550.002 T1550.003 T1552 T1552.001 T1552.002 T1552.003 T1552.004 T1552.005 T1552.006 T1552.007 T1553 T1553.001 T1553.003 T1553.004 T1553.005 T1553.006 T1554 T1555.004 T1555.005 T1556 T1556.001 T1556.002 T1556.003 T1556.004 T1556.008 T1556.009 T1557 T1557.001 T1557.002 T1557.003 T1557.004 T1558 T1558.001 T1558.002 T1558.003 T1558.004 T1559 T1559.001 T1559.002 T1559.003 T1560 T1560.001 T1561 T1561.001 T1561.002 T1562 T1562.001 T1562.002 T1562.003 T1562.004 T1562.006 T1562.009 T1562.010 T1562.011 T1562.012 T1563 T1563.001 T1563.002 T1564.002 T1564.006 T1564.007 T1564.009 T1565 T1565.001 T1565.002 T1565.003 T1566 T1566.001 T1566.002 T1569 T1569.002 T1570 T1571 T1572 T1573 T1573.001 T1573.002 T1574 T1574.001 T1574.004 T1574.005 T1574.006 T1574.007 T1574.008 T1574.009 T1574.010 T1574.013 T1574.014 T1578 T1578.001 T1578.002 T1578.003 T1590.002 T1598 T1598.002 T1598.003 T1599 T1599.001 T1601 T1601.001 T1601.002 T1602 T1602.001 T1602.002 T1609 T1610 T1611 T1612 T1613 T1622 T1647 T1648 T1653
MPA Content Security Program 5.3.1 TS-1.1 TS-1.2 TS-2.3 TS-2.4 TS-2.6 TS-2.8
NIST 800-53 R4 CM-2 CM-2(3) CM-6 SA-8
NIST 800-53 R5.2 CM-02 CM-06 PL-10 SA-08 SA-15(05)
NIST 800-53B R5 (low) (source) CM-02 CM-06 PL-10 SA-08
NIST 800-53B R5 (moderate) (source) CM-02 CM-06 PL-10 SA-08
NIST 800-53B R5 (high) (source) CM-02 CM-06 PL-10 SA-08
NIST SP 800-66 R2 164.312(a) 164.312(e)(1)
NIST 800-82 R3 CM-02 CM-06 PL-10 SA-08 SA-15(05)
NIST 800-82 R3 LOW OT Overlay CM-02 CM-06 PL-10 SA-08
NIST 800-82 R3 MODERATE OT Overlay CM-02 CM-06 PL-10 SA-08
NIST 800-82 R3 HIGH OT Overlay CM-02 CM-06 PL-10 SA-08
NIST 800-160 Vol2 R1 SA-15(05)
NIST 800-161 R1 CM-2 CM-6 PL-10 SA-8
NIST 800-161 R1 C-SCRM Baseline CM-2 CM-6 PL-10 SA-8
NIST 800-161 R1 Flow Down CM-2 CM-6
NIST 800-161 R1 Level 1 SA-8
NIST 800-161 R1 Level 2 CM-2 CM-6 PL-10 SA-8
NIST 800-161 R1 Level 3 CM-2 CM-6 PL-10 SA-8
NIST 800-171 R2 (source) 3.3.3 3.4.1 3.4.2
NIST 800-171 R3 (source) 03.01.01.h 03.01.03 03.01.08.a 03.01.08.b 03.01.09 03.01.10.a 03.01.10.b 03.01.10.c 03.01.11 03.01.12.a 03.01.16.a 03.01.16.c 03.01.18.a 03.03.08.a 03.04.01.a 03.04.02.a 03.04.02.b 03.04.06.a 03.04.06.b 03.04.06.d 03.05.04 03.05.07.c 03.05.07.d 03.05.07.e 03.05.07.f 03.05.12.d 03.07.05.b 03.08.07.a 03.13.12.b
NIST 800-171A (source) 3.4.1[a] 3.4.1[b] 3.4.1[c] 3.4.2[a] 3.4.2[b]
NIST 800-171A R3 (source) A.03.01.01.h A.03.01.03[01] A.03.01.03[02] A.03.01.08.a A.03.01.08.b A.03.01.09 A.03.01.10.a A.03.01.10.b A.03.01.10.c A.03.01.11 A.03.01.12.a[03] A.03.01.16.a[03] A.03.01.16.c A.03.01.18.a[02] A.03.03.08.a[02] A.03.04.01.a[01] A.03.04.01.a[02] A.03.04.02.a[01] A.03.04.02.a[02] A.03.04.06.ODP[01] A.03.04.06.ODP[02] A.03.04.06.ODP[03] A.03.04.06.ODP[04] A.03.04.06.ODP[05] A.03.04.06.a A.03.04.06.b[01] A.03.04.06.b[02] A.03.04.06.b[03] A.03.04.06.b[04] A.03.04.06.b[05] A.03.04.06.d A.03.05.04[01] A.03.05.04[02] A.03.05.07.c A.03.05.07.d A.03.05.07.e A.03.05.07.f A.03.05.12.d A.03.07.05.b[01] A.03.08.07.a A.03.13.12.b
NIST 800-172 R3 03.01.04E 03.01.14E 03.01.16E 03.05.01E 03.05.05E 03.12.04E 03.13.06E 03.13.11E 03.13.13E 03.14.11E
NIST 800-172A R3 A.03.01.04E.ODP[01] A.03.01.14E.ODP[03] A.03.01.14E.ODP[04] DS-A.03.01.16E A.03.05.01E.ODP[01] DS-A.03.05.05E DS-A.03.12.04E.c A.03.13.06E.ODP[01] DS-A.03.13.11E[02] A.03.13.13E.ODP[01] A.03.14.11E.ODP[01]
NIST 800-207 NIST Tenet 5
NIST 800-218 PO.5.2 PW.9.1
NIST CSF 2.0 (source) PR.DS-10 PR.PS PR.PS-05
NIST Privacy Framework 1.0 CT.DP-P4 PR.PO-P1 PR.PT-P2
OWASP Top 10 2025 A01:2025 A02:2025 A04:2025 A05:2025 A06:2025 A09:2025 A10:2025
PCI DSS 4.0.1 (source) 1.1 1.2.1 1.2.6 2.2 2.2.1 8.3.2 8.5 10.2 10.2.1 10.2.1.1 10.2.1.2 10.2.1.3 10.2.1.4 10.2.1.5 10.2.1.6 10.2.1.7 10.2.2 10.6 10.6.1 10.6.2 10.6.3 11.2
PCI DSS 4.0.1 SAQ A-EP (source) 1.2.1 1.2.6 2.2.1 8.3.2 10.2.1 10.2.1.1 10.2.1.2 10.2.1.3 10.2.1.4 10.2.1.5 10.2.1.6 10.2.1.7 10.2.2 10.6.1 10.6.2 10.6.3
PCI DSS 4.0.1 SAQ B-IP (source) 1.2.6
PCI DSS 4.0.1 SAQ C (source) 2.2.1 8.3.2 10.2.1.2 10.2.1.4 10.2.1.5 10.2.2 10.6.1 10.6.2 10.6.3
PCI DSS 4.0.1 SAQ D Merchant (source) 1.2.1 1.2.6 2.2.1 8.3.2 10.2.1 10.2.1.1 10.2.1.2 10.2.1.3 10.2.1.4 10.2.1.5 10.2.1.6 10.2.1.7 10.2.2 10.6.1 10.6.2 10.6.3
PCI DSS 4.0.1 SAQ D Service Provider (source) 1.2.1 1.2.6 2.2.1 8.3.2 10.2.1 10.2.1.1 10.2.1.2 10.2.1.3 10.2.1.4 10.2.1.5 10.2.1.6 10.2.1.7 10.2.2 10.6.1 10.6.2 10.6.3
SCF DPMP 2026 7.12
Shared Assessments SIG 2025 N.11
SPARTA 4.0 CM0047 CM0037
SWIFT CSF 2025 1.3 2.3 2.10 4.1 5.2
TISAX ISA 6.0.3 3.1.4
US (26)
Framework Mapping Values
USA Federal CMS MARS-E 2.0 AC-3-IS.1 AC-3-IS.2 AC-3-IS.3 AC-3-IS.4 AC-6-IS.5 AC-8-IS.1 AC-8-IS.2 AC-8-IS.3 AC-17-IS.2 AC-18-IS.1 AC-18-IS.1.a AC-18-IS.1.b AC-18-IS.1.c AC-18-IS.1.d AC-18-IS.1.e AC-18-IS.1.f AC-18-IS.1.g AC-18-IS.1.h AC-18-IS.1.i AC-18-IS.1.j AC-18-IS.1.k AC-18-IS.1.l AC-19-IS.2 AC-19(5)-IS AU-2-IS.1 AU-2-IS.1.a AU-2-IS.1.b AU-2-IS.1.c AU-2-IS.1.d AU-2-IS.1.e AU-2-IS.1.f AU-2-IS.1.g AU-2-IS.1.h AU-2-IS.1.i AU-2-IS.1.j AU-2-IS.1.k AU-2-IS.1.l AU-2-IS.1.m AU-2-IS.1.n AU-2-IS.1.o AU-2-IS.1.p AU-2-IS.1.q AU-2-IS.1.r AU-2-IS.1.s AU-2-IS.1.t AU-2-IS.1.u AU-2-IS.1.v AU-2-IS.1.w AU-2-IS.1.x AU-2-IS.1.y AU-2-IS.2 AU-2-IS.2.a AU-2-IS.2.b AU-2-IS.2.c AU-2-IS.2.d AU-2-IS.2.e AU-2-IS.2.f AU-2-IS.2.g AU-2-IS.2.h AU-2-IS.3 AU-8(1)-IS.2 AU-8(1)-IS.3 CM-2 CM-6 CM-6.a CM-6.b CM-6-IS.2 CM-6-IS.3 CM-7-IS.2 CP-10-IS.1.c IA-2(11)-IS SA-8 SA-11-IS.2
USA Federal CISA CPG 2022 1.E 2.A 2.B 2.G 2.H 2.K 2.N 2.O 2.V
USA Federal DHS CISA TIC 3.0 3.PEP.EM.LCTPR
USA Federal C2M2 2.1 ASSET-3a ASSET-3b ASSET-3c SITUATION-1c SITUATION-1d ARCHITECTURE-2e ARCHITECTURE-3b ARCHITECTURE-3d ARCHITECTURE-3e ARCHITECTURE-3f ARCHITECTURE-3g ARCHITECTURE-3h ARCHITECTURE-3l
USA Federal DoW BaTB OT 2026 2
USA Federal CMMC 2.0 Level 2 AUL2.-3.3.3 CML2.-3.4.1 CML2.-3.4.2
USA Federal DoD Zero Trust Execution Roadmap v1.1 1.8.2 2.5.1 6.6.2 6.6.3
USA Federal CJIS Security Policy 6.0 CM-2 CM-6 PL-10 SA-8
USA Federal 21 CFR Part 11 2025 11.10(d) 11.50(a) 11.50(a)(1) 11.50(a)(2) 11.50(a)(3) 11.50(b) 11.70 11.200(a)(1) 11.200(b)
USA Federal FFIEC ITEH 2016 II.C.10.a II.C.10.b II.C.10.c
USA Federal FedRAMP R5 (low) CM-02 CM-06 PL-10 SA-08
USA Federal FedRAMP R5 (moderate) CM-02 CM-06 PL-10 SA-08
USA Federal FedRAMP R5 (high) CM-02 CM-06 PL-10 SA-08
USA Federal FedRAMP R5 (LI-SaaS) CM-02 CM-06 PL-10 SA-08
USA Federal 45 CFR 155.260 155.260(a)(6)
USA Federal IRS 1075 2021 3.3.8.b CM-2 CM-2(IRS-Defined) CM-6 CM-6(IRS-Defined) SA-8
USA Federal 33 CFR Part 101 Subpart F 101.650(b)(2) 101.650(c)(2)
USA Federal HIPAA Security Rule NIST SP 800-66 R2 § 164.312(a)(2)(iii) § 164.312(e)(1) § 164.312(e)(2)(i) § 164.312(e)(2)(ii)
USA Federal HIPAA Administrative Simplification 2013 § 164.312(a)(2)(iii) § 164.312(e)(1) § 164.312(e)(2)(i) § 164.312(e)(2)(ii)
USA Federal NERC CIP 2024 CIP-010-4 1.1 CIP-010-4 1.1.1 CIP-010-4 1.1.2 CIP-010-4 1.1.3 CIP-010-4 1.1.4 CIP-010-4 1.1.5 CIP-010-4 2.1
USA Federal NSF RIG 2025 5.3.6 / NSF13
USA California CCPA 2025 7123(c)(4)(B) 7123(c)(5) 7123(c)(5)(A) 7123(c)(5)(B) 7123(c)(11)
USA New York DFS 23 NYCRR500 2023 Amd 2 500.6(a) 500.7(a)(5)
USA Texas DIR SCSC 2.2 2025 AC-07-SID.3 AC-07-SID.3.a AC-07-SID.3.b AC-07-SID.3.c AC-07-SID.3.d AC-07-SID.3.e AC-07-SID.3.f AC-07-SID.3.g AC-18-SID.1 CM-02 CM-06 PL-10 PL-10-SID PL-10-SID.1 PL-10-SID.2 SA-08
USA Texas TX-RAMP Level 1 CM-02 CM-06
USA Texas TX-RAMP Level 2 CM-02 CM-06 SA-08
EMEA (25)
Framework Mapping Values
EMEA Germany BAIT 2017 6.8
EMEA Germany C5 2026 AM-05.01B.3 AM-06.02B OPS-05.01AC OPS-26.01B OPS-26.02B OPS-26.03B OPS-34.02B.9 OPS-35.01B PSS-01.02B.1 PSS-11.01B.4
EMEA Spain CCN-STIC 825 op.acc.6 op.exp.2 op.exp.3 mp.sw.1 mp.info.4 mp.s.2
EMEA Spain Royal Decree 311 2022 Article 12(7) Article 20(a) Article 20(c) Article 20(d) Single Transitional Provision(3)
EMEA EU AI Act Article 17.1(e)
EMEA EU DORA 2023 Article 9.3(a) Article 9.3(b) Article 9.3(c) Article 9.3(d)
EMEA EU DORA RTS 2024 Article 8.2(a)(i) Article 11.2(b) Article 11.2(k)(i) Article 13.1(k)
EMEA EU EBA GL/2019/04 3.4.4.36(b)
EMEA EU NIS2 2022 Article 21.5
EMEA EU NIS2 Annex 2024 6.3.2(a) 6.3.2(b) 6.3.3 12.3.2(b)
EMEA UK CAF 4.0 B4 B4.b
EMEA UK Cyber Essentials 3.3 2-BP3 2-BP4
EMEA UK DEFSTAN 05-138 2024 2204 2310 2400 2401 2418
EMEA UK DEFSTAN 05-138 - L1 2024 2204 2310 2400 2401 2418
EMEA UK DEFSTAN 05-138 - L2 2024 2204 2310 2400 2401 2418
EMEA UK DEFSTAN 05-138 - L3 2024 2204 2310 2400 2401 2418
EMEA Israel CDMO 2.0 Appendix A, 3.1 Appendix A, 4.1 Appendix A, 4.2
EMEA LUX CCSF 20/750 2020 3.4.4-36.b
EMEA Saudi Arabia IoT CGIoT-1 2024 1-2-2 2-5-1 2-6-3 2-14-2 2-15-2
EMEA Saudi Arabia CSCC-1 2019 1-3-2-3 2-2-1-5 2-2-1-6 2-3-1-6 2-3-1-7 2-4-1-3 2-12-1
EMEA Saudi Arabia ECC-1 2018 1-3-3 2-4-1
EMEA Saudi Arabia OTCC-1 2022 2-2-1-8 2-4-1-4
EMEA Saudi Arabia SACS-002 2022 VII.A.TPC-2 VII.A.TPC-2-BP1 VII.A.TPC-2-BP2 VII.A.TPC-2-BP3 VII.A.TPC-2-BP4 VII.A.TPC-2-BP5 VII.A.TPC-10 VII.B.TPC-56 VII.B.TPC-62 VII.B.TPC-63 VII.B.TPC-63-BP1 VII.B.TPC-63-BP2 VII.B.TPC-63-BP3 VII.B.TPC-63-BP4
EMEA Saudi Arabia SAMA CSF 1.0 2017 3.3.6 3.3.6.1 3.3.13.4.c.2
EMEA UAE NIAF 2023 3.2.1
APAC (15)
Framework Mapping Values
APAC Australia CCM 2026 PRO-04
APAC Australia IoT Code of Practice 2024 6.0
APAC Australia Essential 8 2024 ISM-1407 ISM-1412 ISM-1485 ISM-1486 ISM-1487 ISM-1488 ISM-1489 ISM-1490 ISM-1542 ISM-1544 ISM-1621 ISM-1622 ISM-1623 ISM-1654 ISM-1655 ISM-1657 ISM-1658 ISM-1659 ISM-1667 ISM-1668 ISM-1669 ISM-1670 ISM-1671 ISM-1672 ISM-1673 ISM-1674 ISM-1675 ISM-1676 ISM-1686 ISM-1823 ISM-1824 ISM-1859 ISM-1860 ISM-1861 ISM-1870 ISM-1871 ISM-1890 ISM-1891 ISM-1896 ISM-1897
APAC Australia ISM June 2026 ISM-0341 ISM-0343 ISM-0345 ISM-0380 ISM-0382 ISM-0383 ISM-0567 ISM-0846 ISM-1316 ISM-1318 ISM-1319 ISM-1321 ISM-1406 ISM-1407 ISM-1408 ISM-1409 ISM-1412 ISM-1418 ISM-1485 ISM-1486 ISM-1487 ISM-1488 ISM-1489 ISM-1490 ISM-1491 ISM-1492 ISM-1542 ISM-1544 ISM-1562 ISM-1584 ISM-1585 ISM-1604 ISM-1608 ISM-1621 ISM-1622 ISM-1623 ISM-1624 ISM-1654 ISM-1655 ISM-1657 ISM-1658 ISM-1659 ISM-1667 ISM-1668 ISM-1669 ISM-1670 ISM-1671 ISM-1672 ISM-1673 ISM-1674 ISM-1675 ISM-1676 ISM-1686 ISM-1710 ISM-1745 ISM-1823 ISM-1824 ISM-1825 ISM-1828 ISM-1829 ISM-1830 ISM-1836 ISM-1838 ISM-1839 ISM-1840 ISM-1841 ISM-1844 ISM-1846 ISM-1858 ISM-1859 ISM-1860 ISM-1861 ISM-1870 ISM-1871 ISM-1886 ISM-1887 ISM-1888 ISM-1890 ISM-1891 ISM-1896 ISM-1897 ISM-1913 ISM-1914 ISM-1915 ISM-1916 ISM-1928 ISM-1929 ISM-1930 ISM-1931 ISM-1932 ISM-1933 ISM-1934 ISM-1935 ISM-1936 ISM-1938 ISM-1943 ISM-1944 ISM-1945 ISM-1946 ISM-1947 ISM-1948 ISM-1949 ISM-1950 ISM-1951 ISM-1952 ISM-1953 ISM-1954 ISM-1955 ISM-1956 ISM-1957 ISM-1958 ISM-1962 ISM-1980 ISM-1984 ISM-2010 ISM-2012 ISM-2079 ISM-2080 ISM-2081 ISM-2096 ISM-2097 ISM-2098 ISM-2110 ISM-2111 ISM-2123
APAC India RBI Digital Payments 2021 71.a
APAC India SEBI CSCRF 2024 PR.IP.S1
APAC Japan ISMAP 8.3.1.9
APAC Malaysia RMiT 2025 10.17(a) A2-C9 A2-C9(c) A2-C10 A2-C10(e) A2-C11 A2-NC6 A4-3(a) A10-B3(b)(v)
APAC New Zealand HISF Microsmall 2023 HMS09
APAC New Zealand HISF MLHSP 2023 HHSP54 HHSP60 HHSP65 HML16 HML54 HML60 HML64
APAC New Zealand HISF Suppliers 2023 HSUP14 HSUP46 HSUP52
APAC New Zealand NZISM 3.9 11.1.16.C.01 11.1.16.C.02 11.1.17.C.01 11.1.17.C.03 11.8.6.C.01 11.8.6.C.02 14.1.8.C.01 14.1.9.C.01 14.1.9.C.02 14.1.10.C.01 14.1.10.C.02 14.3.7.C.01 15.2.41.C.01 15.2.41.C.02 15.2.42.C.01 15.2.43.C.01 15.2.44.C.01 15.2.46.C.01 15.2.46.C.03 15.2.47.C.01 15.2.47.C.02 15.2.48.C.01 15.2.48.C.02 15.2.48.C.03 15.2.49.C.01 15.2.49.C.02 15.2.49.C.03 15.2.50.C.01 15.2.50.C.02 15.2.50.C.03 15.2.50.C.04 16.1.31.C.03 16.1.31.C.04 16.1.31.C.05 16.7.42.C.01 18.1.15.C.03 18.1.15.C.04 20.2.14.C.05 20.2.14.C.07 22.1.16.C.01 22.1.16.C.02 22.1.17.C.01 22.1.17.C.02 22.1.17.C.03 22.1.19.C.01 22.1.19.C.02 23.2.21.C.01
APAC Singapore CCOP CII 2026 5.9.1 5.9.1(a) 5.9.1(b) 5.9.1(c) 5.9.1(d) 5.9.1(e) 5.9.1(f) 5.9.1(g) 5.9.2 5.11.2
APAC Singapore Cyber Hygiene Practice 2019 4.3(a) 4.3(b)
APAC Singapore MAS TRM 2021 6.4.4 7.2.2 11.1.5 11.3.1
Americas (5)
Framework Mapping Values
Americas Argentina Reg 132 2018 B.2.4-4 E.1.2-5
Americas Bermuda BMACCC 2020 6.15-BP5
Americas Canada ITSP-10-171 2025 03.01.01.H 03.01.03 03.01.08.A 03.01.08.B 03.01.09 03.01.10.A 03.01.10.B 03.01.10.C 03.01.11 03.01.12.A 03.01.16.A 03.01.16.C 03.01.18.A 03.03.08.A 03.04.01.A 03.04.02.A 03.04.02.B 03.04.06.A 03.04.06.B 03.04.06.D 03.05.04 03.05.07.C 03.05.07.D 03.05.07.E 03.05.07.F 03.05.12.D 03.07.05.B 03.08.07.A 03.13.12.B
Americas Canada OSFI B-13 2022 3.2.8
Americas Canada OSFI Self-Assessment Guidance 3.2.8

Capability Maturity Model

Level 0 — Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 — Performed Informally

Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 2 — Planned & Tracked

Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides). ▪ The restrictiveness of the SBCs are commensurate with the criticality of the TAAS and/or sensitivity of the data being protected, in accordance with applicable laws, regulations and frameworks. ▪ Tailored SBC are created for higher-risk operating environments and/or for TAAS that store, process or transmit sensitive/regulated data.

Level 3 — Well Defined

Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted system hardening standards.

Level 4 — Quantitatively Controlled

Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 — Continuously Improving

Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. ▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.

Assessment Objectives

  1. CFG-04_A01 a current baseline configuration for systems, applications and services is developed and documented.
  2. CFG-04_A02 the baseline configuration includes hardware, software, firmware and documentation.
  3. CFG-04_A03 security configuration settings for information technology products employed in the system are enforced.
  4. CFG-04_A04 the baseline configuration is maintained (reviewed / updated) throughout the system development life cycle under configuration control.
  5. CFG-04_A05 configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using organization-defined common secure configurations.
  6. CFG-04_A06 thresholds to which attack surfaces are to be reduced are defined.
  7. CFG-04_A07 the developer of the system, system component or system service is required to reduce attack surfaces to organization-defined thresholds.
  8. CFG-04_A08 a control baseline for the system is selected.
  9. CFG-04_A09 approved authorizations are enforced for controlling the flow of CUI within the system.
  10. CFG-04_A10 configuration requirements are established for each type of wireless access to the system.
  11. CFG-04_A11 wireless networking capabilities not intended for use are disabled prior to issuance and deployment.
  12. CFG-04_A12 configuration requirements are established for mobile devices.
  13. CFG-04_A13 audit logging tools are protected from unauthorized access, modification, and deletion.
  14. CFG-04_A14 a current baseline configuration of the system is developed.
  15. CFG-04_A15 a current baseline configuration of the system is maintained under configuration control.
  16. CFG-04_A16 the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements are established and documented: <A.03.04.02.ODP[01]: configuration settings>.
  17. CFG-04_A17 the following configuration settings for the system are implemented: <A.03.04.02.ODP[01]: configuration settings>.
  18. CFG-04_A18 functions to be prohibited or restricted are defined.
  19. CFG-04_A19 ports to be prohibited or restricted are defined.
  20. CFG-04_A20 protocols to be prohibited or restricted are defined.
  21. CFG-04_A21 connections to be prohibited or restricted are defined.
  22. CFG-04_A22 services to be prohibited or restricted are defined.
  23. CFG-04_A23 the use of the following functions is prohibited or restricted: <A.03.04.06.ODP[01]: functions>.
  24. CFG-04_A24 the use of the following ports is prohibited or restricted: <A.03.04.06.ODP[02]: ports>.
  25. CFG-04_A25 the use of the following protocols is prohibited or restricted: <A.03.04.06.ODP[03]: protocols>.
  26. CFG-04_A26 the use of the following connections is prohibited or restricted: <A.03.04.06.ODP[04]: connections>.
  27. CFG-04_A27 the use of the following services is prohibited or restricted: <A.03.04.06.ODP[05]: services>.
  28. CFG-04_A28 replay-resistant authentication mechanisms for access to privileged accounts are implemented.
  29. CFG-04_A29 replay-resistant authentication mechanisms for access to non-privileged accounts are implemented.
  30. CFG-04_A30 passwords are only transmitted over cryptographically protected channels.
  31. CFG-04_A31 passwords are stored in a cryptographically protected form.
  32. CFG-04_A32 a new password is selected upon first use after account recovery.
  33. CFG-04_A33 organization-defined composition and complexity rules for passwords are enforced.
  34. CFG-04_A34 replay resistance is implemented in the establishment of nonlocal maintenance and diagnostic sessions.
  35. CFG-04_A35 the following composition and complexity rules for passwords are enforced: <A.03.05.07.ODP[02]: rules>.

Evidence Requirements

E-AST-12 Secure Baseline Configurations Reviews

Documented evidence of a review process to ensure Secure Baseline Configurations (SBC) are current and applicable (e.g., system configuration settings and associated documentation).

Asset Management
E-AST-13 Secure Baseline Configurations - Cloud-Based Services

Documented evidence of secure baseline configurations for all deployed types of cloud-based services or applications.

Asset Management
E-AST-14 Secure Baseline Configurations - Databases

Documented evidence of secure baseline configurations for all deployed types of databases.

Asset Management
E-AST-15 Secure Baseline Configurations - Embedded Technologies

Documented evidence of secure baseline configurations for all deployed types of embedded technologies.

Asset Management
E-AST-16 Secure Baseline Configurations - Major Applications

Documented evidence of secure baseline configurations for all deployed types of major applications.

Asset Management
E-AST-17 Secure Baseline Configurations - Minor Applications

Documented evidence of secure baseline configurations for all deployed types of minor applications.

Asset Management
E-AST-18 Secure Baseline Configurations - Mobile Devices

Documented evidence of secure baseline configurations for all deployed types of mobile devices.

Asset Management
E-AST-19 Secure Baseline Configurations - Network Devices

Documented evidence of secure baseline configurations for all deployed types of network devices.

Asset Management
E-AST-20 Secure Baseline Configurations - Server Class Systems

Documented evidence of secure baseline configurations for all deployed types of server-class operating systems.

Asset Management
E-AST-21 Secure Baseline Configurations - Workstation Class Systems

Documented evidence of secure baseline configurations for all deployed types of workstation-class operating systems.

Asset Management

Technology Recommendations

Micro/Small

  • Secure Baseline Configurations (SBC)
  • Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)
  • Center for Internet Security (CIS) Benchmarks
  • Original Equipment Manufacturer (OEM) security guides

Small

  • Secure Baseline Configurations (SBC)
  • Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)
  • Center for Internet Security (CIS) Benchmarks
  • Original Equipment Manufacturer (OEM) security guides

Medium

  • Secure Baseline Configurations (SBC)
  • Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)
  • Center for Internet Security (CIS) Benchmarks
  • Original Equipment Manufacturer (OEM) security guides
  • CimTrak Integrity Suite (https://cimcor.com/cimtrak)
  • Netwrix Auditor (https://netrix.com)

Large

  • Secure Baseline Configurations (SBC)
  • Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)
  • Center for Internet Security (CIS) Benchmarks
  • Original Equipment Manufacturer (OEM) security guides
  • CimTrak Integrity Suite (https://cimcor.com/cimtrak)
  • Netwrix Auditor (https://netrix.com)

Enterprise

  • Secure Baseline Configurations (SBC)
  • Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)
  • Center for Internet Security (CIS) Benchmarks
  • Original Equipment Manufacturer (OEM) security guides
  • CimTrak Integrity Suite (https://cimcor.com/cimtrak)
  • Netwrix Auditor (https://netrix.com)

The Secure Controls Framework (SCF) is maintained by SCF Council. Use of SCF content is subject to the SCF Terms & Conditions.

Manage this control in SCF Connect

Track implementation status, collect evidence, and map controls to your compliance frameworks automatically.

Get Started Free