CISA Cloud Security Technical Reference Architecture v2.0 5.2d: Protect infrastructure and applications: scan everything, segment networks, harden configurations, shield applications and manage vulnerabilities with a disclosure policy

What does 5.2d require?

Vulnerability management procedures and tools scan virtual machines, virtual networks, applications, containers (images before deployment) and other services, with alerts and automated restoration of altered configurations to the baseline; network configuration sets permissions, segmentation, firewalls, proxies and certificates correctly, isolates systems by location, application, environment or resource type, encrypts connections and uses phishing-resistant MFA; resource protection relies on correct provider service configuration and SLA provisions; applications get layer-7 firewalls, DDoS mitigation, platform, middleware and container scanning and pre-release scanning, with application-to-resource access and application accounts tightly limited; and periodic scanning keeps systems patched and removes obsolete software, with a public vulnerability disclosure policy as required.