Internal rules and instructions govern five activities: keeping the software and firmware library current; managing access to it; following newly discovered vulnerabilities in the software and firmware in use and the updates, patches or mitigations their makers publish; acquiring updates and verifying their origin and integrity before installation; and applying updates and recommended measures through the change process in Article 11. Devices and systems are configured according to the security recommendations of their suppliers and the requirements of Annex 4 (macros disabled in office suites, browser pop-ups blocked, AutoPlay prompting, User Account Control at its highest level, no Everyone shares, TRACE and TRACK disabled, no anonymous authentication, unicast reverse-path forwarding and rate limiting, TLS renegotiation disabled or rate-limited, terse error messages, no AutoComplete, advertising blocked). An offline copy of current configuration files or a description of settings is kept with controlled access and checked regularly for quality and fitness, and configurations are checked regularly for unauthorised changes.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.