Frameworks / ASD Strategies to Mitigate Cyber Security Incidents / ASD37-11 ASD Strategies to Mitigate Cyber Security Incidents
Preventing Malware Delivery and Execution
ASD Strategies to Mitigate Cyber Security Incidents ASD37-11: Operating system hardening (Very Good) Harden operating systems based on vendor guidance and ASD guidance. Remove unneeded software, services and ports.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 140 controls across 69 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
ASBv3-NS-8 Detect and disable insecure services and protocols ASBv3-PV-1 Define and establish secure configurations ASBv3-PV-3 Define and establish secure configurations for compute resources ASBv3-PV-4 Audit and enforce secure configurations for compute resources PV-2 Audit and enforce secure configurations CIS-2.3 Address Unauthorized Software CIS-4.1 Establish and Maintain a Secure Configuration Process CIS-4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CM-2 Baseline Configuration CM-6 Configuration Settings CM-7 Least Functionality CM-7(1) Periodic Review CM-2 Baseline Configuration CM-6 Configuration Settings CM-7 Least Functionality CM-7(1) Periodic Review 1.2.5 1.2.5 Allowed services, protocols and ports justified 2.2.1 2.2.1 System configuration standards maintained 2.2.4 2.2.4 Only necessary functionality enabled 2.2.6 2.2.6 System security parameters configured against misuse BSI-23 Baseline configuration establishment BSI-24 Configuration change control BSI-26 System component inventory FEDRAMP-CM-1 Configuration Management Policy FEDRAMP-CM-2 Baseline Configuration FedRAMP-Boundary Authorization Boundary, SSP, SAR, POA&M documentation CE-SC.1 Remove or Disable Unused Software CE-SC.3 Disable Auto-Run Features CE-SU.4 Remove Out-of-Support Software ANSSI-HYG-12 Change Default Authentication Elements on Equipment and Services ANSSI-HYG-14 Apply a Minimum Security Level Across the Whole Estate API1164-14 Physical Security API1164-22 Configuration management for OT systems C5-OPS-23 Managing Vulnerabilities, Malfunctions and Errors - System Hardening C5-PSS-11 Images for Virtual Machines and Containers FISMA-3554-Agency-Responsibilities Federal Agency Responsibilities (44 USC 3554) - CIO + CISO + Program + Reporting FISMA-NIST-800-53-RMF-800-171-FIPS Operationalisation via NIST 800-53 + 800-37 RMF + 800-171 + FIPS 199 + FIPS 200 IEC62304-4.1 Quality Management System IEC62304-5.1 Software Development Planning IEC62443-14 System security hardening IEC62443-22 Configuration management for OT systems ISO27019-14 System security hardening ISO27019-22 Configuration management for OT systems NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration NISTSP82-5 OT Configuration Management, Patching, Vulnerability Management, and Malware Protection SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11) SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities E8-UAH-ML2 User Application Hardening - Maturity Level 2 AS9100D-8.1 Operational Planning and Control AWWA-4.3 Configuration Management Clause 10 Change and configuration management SUP.8 Configuration Management CA-ITSG33-SC-01 Security Control Catalogue CJIS-7 Configuration Management CAT-D3-3 Corrective controls FFIEC-10 Secure configuration standards GAMP5-Supplier-Operations-Change-Periodic Supplier Assessment, Operational Phase, Change Control and Periodic Review GLBA-Subordinate-Rules-Operationalisation GLBA Operationalisation through FTC Safeguards Rule, Privacy Rule, SEC Reg S-P and Banking-Agency Guidelines GhCSA-Implementation-Roadmap Implementation Roadmap - Organizational Roles, Tooling and Metrics HKMA-CRAF-Domain3-4-Protection-Detection HKMA C-RAF Domain 3 (Protection) + Domain 4 (Detection) - Access, Data, Infrastructure, Application, Monitoring, Testing, Threat Intel HKMA-SPM-TM-Technology-TM-G-1-CRAF-Coord HKMA SPM Technology Management Modules (TM-G-1 to TM-G-4, TM-E-1) + Coordination with C-RAF IACS-UR-E27-Equipment-Hardening-SecureConfig-Communications IACS UR E27 - Equipment Hardening + Secure Configuration + Secure Communications + Cryptography IEEE1686-Section5.5-5.6-5.7-5.8-Firmware-ConfigSW-TimeSync-DataAtRest IEEE 1686 Section 5.5-5.8 - Firmware Quality + Configuration Software Security + Time Synchronisation + Data Protection at Rest + Patch + Malware + Hardening + Vulnerability ISO-26262-8-7 Configuration management 8.9 Configuration management 8.9 Configuration management ISO20000-10 Configuration management 27400-6.4 Default Configuration Security ITIL4-10 Configuration management MTCS-Logging-Monitoring-Compliance-Audit-SLA-Configuration-SIEM-SOAR-Cloud-Monitoring-CSPM MTCS Logging + Monitoring + Compliance + Audit + SLA + Configuration + SIEM + SOAR + CSPM MAS-TRM-Access-Cryptography-Network-Security-Chapters-9-10-MFA-PKI-Encryption-Network-Segmentation MAS TRM Access Control + Cryptography + Network + Chapters 9-10 + MFA + PKI + Encryption + Network Segmentation NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010) NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) NISTSP144-7 Cloud Workload Protection, Containers, Serverless, and Configuration NISTSP146-4 IaaS Operational Recommendations and Workload Hardening OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management OMANCS-5 Network, Endpoint, System Development, and Configuration Security OPENBANK-3 Mutual TLS, Token Binding, Request Signing (JWS), Key Management PCI-P2PE-10 Secure configuration standards PCI-PIN-10 Secure configuration standards PCI-SSF-10 Secure configuration standards PSDTWO-2 SCA Exemptions and Risk-Based Authentication CISABD-1 Take Ownership of Customer Security Outcomes ISMSP-SYS-01 System Hardening and Patch Management Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Preventing Malware Delivery and Execution You are reading one control. How much of ASD Strategies to Mitigate Cyber Security Incidents have you already done? ASD Strategies to Mitigate Cyber Security Incidents ASD37-11 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ASD Strategies to Mitigate Cyber Security Incidents your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 32 of 37 ASD Strategies to Mitigate Cyber Security Incidents controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 140 it maps to, and the evidence behind each claim, over MCP and REST.