UK Cyber Essentials
Secure Configuration

UK Cyber Essentials CE-SC.1: Remove or Disable Unused Software

Remove or disable unnecessary user accounts, software, and services on devices to reduce the attack surface.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 56 controls across 20 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 5 controls

  • CIS-2.3 Address Unauthorized Software
  • CIS-4.1 Establish and Maintain a Secure Configuration Process
  • CIS-4.7 Manage Default Accounts on Enterprise Assets and Software
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software
  • CIS-9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions

FedRAMP High · 5 controls

FedRAMP Moderate · 5 controls

ASD Strategies to Mitigate Cyber Security Incidents · 4 controls

  • ASD37-04 User application hardening (Essential)
  • ASD37-10 Server application hardening (Very Good)
  • ASD37-11 Operating system hardening (Very Good)
  • ASD37-21 Disable local administrator accounts (Excellent)

Azure Security Benchmark · 4 controls

  • AM-3 Ensure security of asset lifecycle management
  • ASBv3-NS-8 Detect and disable insecure services and protocols
  • ASBv3-PV-3 Define and establish secure configurations for compute resources
  • PA-3 Manage lifecycle of identities and entitlements

NIST SP 800-53 Rev 5 · 4 controls

PCI DSS 4.0 · 4 controls

  • 2.2.1 2.2.1 System configuration standards maintained
  • 2.2.2 2.2.2 Vendor default accounts managed
  • 2.2.4 2.2.4 Only necessary functionality enabled
  • 6.5.6 6.5.6 Remove test data and accounts before production

CMMC 2.0 · 3 controls

ISO 27001:2022 · 3 controls

  • 8.1 User end point devices
  • 8.19 Installation of software on operational systems
  • 8.9 Configuration management

ISO 27002:2022 · 3 controls

  • 8.1 User endpoint devices
  • 8.19 Installation of software on operational systems
  • 8.9 Configuration management

NIST SP 800-171 Rev 3 · 3 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

HIPAA Security Rule · 2 controls

NIST Cybersecurity Framework 2.0 · 2 controls

NIST SP 800-66 Rev 2 · 2 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-14 Apply a Minimum Security Level Across the Whole Estate

AWS Well-Architected Security Pillar · 1 control

C5 (Germany) · 1 control

  • C5-OPS-23 Managing Vulnerabilities, Malfunctions and Errors - System Hardening

NIST SP 800-161 Rev 1 · 1 control

SOC 2 · 1 control

  • SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Secure Configuration

You are reading one control. How much of UK Cyber Essentials have you already done?

UK Cyber Essentials CE-SC.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of UK Cyber Essentials your existing evidence covers. Hold FedRAMP Moderate and 29 of 36 UK Cyber Essentials controls already carry evidence.

If you hold FedRAMP Moderate80.6% covered · 7 gapsIf you hold NIST SP 800-171 Rev 375% covered · 9 gapsIf you hold Azure Security Benchmark55.6% covered · 16 gapsIf you hold ANSSI Guide d'hygiene informatique (42 mesures, v2.0)50% covered · 18 gapsIf you hold ASD Strategies to Mitigate Cyber Security Incidents50% covered · 18 gapsIf you hold C5 (Germany)50% covered · 18 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the FedRAMP Moderate pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 56 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll UK Cyber Essentials controls