ASD Strategies to Mitigate Cyber Security Incidents
Preventing Malware Delivery and Execution

ASD Strategies to Mitigate Cyber Security Incidents 11: Operating system hardening (Very Good)

Harden operating systems based on vendor guidance and ASD guidance. Remove unneeded software, services and ports.

What else in your programme already covers this

This control maps to 155 controls across 75 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 6 controls

  • ASBv3-NS-8 Detect and disable insecure services and protocols
  • ASBv3-PV-1 Define and establish secure configurations
  • ASBv3-PV-3 Define and establish secure configurations for compute resources
  • ASBv3-PV-4 Audit and enforce secure configurations for compute resources
  • PV-2 Audit and enforce secure configurations

CIS Controls v8 · 4 controls

  • CIS-2.3 Address Unauthorized Software
  • CIS-4.1 Establish and Maintain a Secure Configuration Process
  • CIS-4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software

CMMC 2.0 · 4 controls

FedRAMP High · 4 controls

  • CM-2 Baseline Configuration
  • CM-6 Configuration Settings
  • CM-7 Least Functionality
  • CM-7(1) Periodic Review

FedRAMP Moderate · 4 controls

  • CM-2 Baseline Configuration
  • CM-6 Configuration Settings
  • CM-7 Least Functionality
  • CM-7(1) Periodic Review
  • CM-2 Baseline Configuration
  • CM-6 Configuration Settings
  • CM-7 Least Functionality
  • CM-7(1) Periodic Review
  • CM-2 Baseline Configuration
  • CM-6 Configuration Settings
  • CM-7 Least Functionality
  • CM-7(1) Periodic Review

PCI DSS 4.0 · 4 controls

  • 1.2.5 Services, protocols, ports inventoried and justified
  • 2.2.1 Configuration standards are developed, implemented, and maintained to: • Cover all system components. • Address all known security vulnerabilities. • Be consistent with industry-accepted system hardening standards or vendor hardening recommendations. • Be updated
  • 2.2.4 Only necessary services enabled
  • 2.2.6 System security parameters configured

BSI IT-Grundschutz · 3 controls

  • BSI-23 Baseline configuration establishment
  • BSI-24 Configuration change control
  • BSI-26 System component inventory

NIST SP 800-171 Rev 3 · 3 controls

  • CM-2 Baseline Configuration
  • CM-6 Configuration Settings
  • CM-7 Least Functionality

UK Cyber Essentials · 3 controls

  • CE-SC.1 Remove or Disable Unused Software
  • CE-SC.3 Disable Auto-Run Features
  • CE-SU.4 Remove Out-of-Support Software
  • ANSSI-HYG-12 Change Default Authentication Elements on Equipment and Services
  • ANSSI-HYG-14 Apply a Minimum Security Level Across the Whole Estate

API 1164 · 2 controls

C5 (Germany) · 2 controls

  • C5-OPS-23 Managing Vulnerabilities, Malfunctions and Errors - System Hardening
  • C5-PSS-11 Images for Virtual Machines and Containers

FISMA · 2 controls

IEC 62443 · 2 controls

ISO 27017 · 2 controls

ISO 27018 · 2 controls

ISO 27019 · 2 controls

NIST SP 1800-32 · 2 controls

NIST SP 800-145 · 2 controls

  • NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition
  • NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition

NIST SP 800-161 Rev 1 · 2 controls

NIST SP 800-190 · 2 controls

  • NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration
  • NISTSP82-5 OT Configuration Management, Patching, Vulnerability Management, and Malware Protection

SOC 2 · 2 controls

  • SOC2-CC5.2 COSO principle 11: Selects and develops general controls over technology
  • SOC2-CC7.1 Detection and monitoring procedures for security events are in place
  • E8-UAH-ML2 User Application Hardening - Maturity Level 2
  • Clause 10 Change and configuration management
  • CJIS-7 Configuration Management

FedRAMP Rev 5 · 1 control

GLBA · 1 control

HKMA SPM · 1 control

IEEE 1686 · 1 control

ISMAP (Japan) · 1 control

ISO 20000-1 · 1 control

ISO 27001:2022 · 1 control

  • 8.9 Configuration management

ISO 27002:2022 · 1 control

  • 8.9 Configuration management

ISO/IEC 27400:2022 · 1 control

ITIL 4 · 1 control

MTCS (Singapore) · 1 control

NERC CIP · 1 control

  • NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010)
  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 800-144 · 1 control

  • NISTSP144-7 Cloud Workload Protection, Containers, Serverless, and Configuration

NIST SP 800-146 · 1 control

  • NISTSP146-4 IaaS Operational Recommendations and Workload Hardening

OSFI B-13 · 1 control

  • OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery
  • DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management
  • OMANCS-5 Network, Endpoint, System Development, and Configuration Security
  • OPENBANK-3 Mutual TLS, Token Binding, Request Signing (JWS), Key Management

PCI P2PE · 1 control

PCI PIN Security · 1 control

PCI SSF · 1 control

PSD2 SCA · 1 control

  • PSDTWO-2 SCA Exemptions and Risk-Based Authentication
  • CISABD-1 Take Ownership of Customer Security Outcomes

South Korea ISMS-P · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Preventing Malware Delivery and Execution

You are reading one control. How much of ASD Strategies to Mitigate Cyber Security Incidents have you already done?

ASD Strategies to Mitigate Cyber Security Incidents 11 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ASD Strategies to Mitigate Cyber Security Incidents your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 32 of 37 ASD Strategies to Mitigate Cyber Security Incidents controls already carry evidence.

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST SP 800-53 Rev 5 pair alone.

Query this from an agent

The graph holds this control, the 155 it maps to, and the evidence behind each claim, over MCP and REST.