{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"technical","domain":"Secure Configuration & Change Management","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-CONFIG-01","description":"Establish, document, and maintain current baseline configurations and mandatory secure settings for all system components, including network security controls, aligned to accepted industry hardening standards. Configure systems for least functionality by disabling or restricting unnecessary ports, protocols, services, and functions. Monitor deployed configurations for deviations from baseline and for changes that introduce vulnerabilities, remediating drift as findings, and reassess baselines periodically and upon significant change.","details":{"control_category":"technical","control_type":"preventive","domain":"Secure Configuration & Change Management","guidance":[],"members":[{"control_id":"CM-2","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"CM-6","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"CM-7","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"PR.PS-01","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"},{"control_id":"A.8.9","coverage":"full","framework":"iso-27001","relationship":"superset_of"},{"control_id":"CC7.1","coverage":"partial","delta":"also requires monitoring susceptibility to newly discovered vulnerabilities","framework":"soc2","relationship":"intersects_with"},{"control_id":"PCI-Req1","coverage":"partial","delta":"also mandates dedicated network security controls and periodic ruleset reviews","framework":"pci-dss","relationship":"intersects_with"},{"control_id":"PCI-Req2","coverage":"full","framework":"pci-dss","relationship":"superset_of"}],"statement":"Establish, document, and maintain current baseline configurations and mandatory secure settings for all system components, including network security controls, aligned to accepted industry hardening standards. Configure systems for least functionality by disabling or restricting unnecessary ports, protocols, services, and functions. Monitor deployed configurations for deviations from baseline and for changes that introduce vulnerabilities, remediating drift as findings, and reassess baselines periodically and upon significant change.","title":"Harden systems to approved secure configuration baselines","unified_id":"UC-CONFIG-01"},"id":"uc:UC-CONFIG-01","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-CONFIG-01","sourceIds":["iso-27001","nist-800-53","nist-csf-2","pci-dss","soc2"],"sourceUrl":null,"title":"UC-CONFIG-01 — Harden systems to approved secure configuration baselines","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:08c0c2135b538725e92dd073405f085cb5b0667bdfee92f1e599600fd650db14","properties":{},"sourceDetailPath":"/data/v1/records/wf-a15-e859f6b8.json","sourceId":"wf:A15","targetDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","targetId":"uc:UC-CONFIG-01","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1206dd825a735b202f1e7ac664fecccb42ae6ebd257bbebb8dfa10c8a0900d59","properties":{"control_id":"PCI-Req1","coverage":"partial","delta":"also mandates dedicated network security controls and periodic ruleset reviews","framework":"pci-dss","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"v4.0.1"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/ctrl-pci-dss-pci-req1-c3c41ca4.json","targetId":"ctrl:pci-dss:PCI-Req1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:15e92c1e1284f358205d750de51a3b8c7690252a0cb5ba2023fe594b59986692","properties":{"rationale":"Hardening network security controls (e.g., firewall baselines) contributes to boundary protection, but segmentation/DMZ architecture is the operative defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/risk-net-poor-perimeter-architecture-26b5f06f.json","targetId":"risk:net-poor-perimeter-architecture","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1a84fcd4490ea6a7bf0096c5b200da0f8e1abc61657a295dcfc63076d89063ab","properties":{"rationale":"Secure baselines plus least functionality (disabling unnecessary ports/protocols/services) remove the misconfigurations and unauthorized services attackers exploit.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/risk-config-internet-exposed-misconfig-61b3613a.json","targetId":"risk:config-internet-exposed-misconfig","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1b777a1e099f3980a164c89762b850830df910209f8a024d21d4184bb28f6093","properties":{},"sourceDetailPath":"/data/v1/records/wf-d06-c9616fb8.json","sourceId":"wf:D06","targetDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","targetId":"uc:UC-CONFIG-01","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2b7cc55fa393b275119d154303df369b20b6489b712a8b4533733ae8f33bd75a","properties":{"rationale":"Least-functionality hardening disables vulnerable services and shrinks the exploitable surface, reducing exposure to known flaws; patching is the operative control.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/risk-vuln-unpatched-known-flaws-c4a6b075.json","targetId":"risk:vuln-unpatched-known-flaws","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:539d6269f1b8d523fe4babe83874b06eea8bd7b7f12e4aceead61cb24f28f376","properties":{"rationale":"Establishing enforced baselines and monitoring/remediating deviations is the direct defense against insecure configuration drift.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/risk-config-poor-baseline-drift-2dd66324.json","targetId":"risk:config-poor-baseline-drift","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5d52f2055953fe737ee10babb032dda07f79f43ac7836cee7524f79c717db230","properties":{"control_id":"CC7.1","coverage":"partial","delta":"also requires monitoring susceptibility to newly discovered vulnerabilities","framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/ctrl-soc2-cc7-1-a0583d17.json","targetId":"ctrl:soc2:CC7.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:630dd4ba86cad7e4c4089f19732a6a8b5d4175c04b0e44e8927520eaccfb0fd8","properties":{},"sourceDetailPath":"/data/v1/records/wf-d24-a9f3daf6.json","sourceId":"wf:D24","targetDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","targetId":"uc:UC-CONFIG-01","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7fa148bac926bff185550f196e560015e3c1a610714c2d4e0ea778a0454bd4ae","properties":{"control_id":"PR.PS-01","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-pr-ps-01-e2a7a422.json","targetId":"ctrl:nist-csf-2:PR.PS-01","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:89434b84abc1f459e41807615c2b707092e06b2fa2b207ade2d05148cff70535","properties":{"control_id":"PCI-Req2","coverage":"full","delta":null,"framework":"pci-dss","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"v4.0.1"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/ctrl-pci-dss-pci-req2-586d7ab1.json","targetId":"ctrl:pci-dss:PCI-Req2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9660842dfd0260c1bda8df404caf02c74a52512590e36108d0e0a701c729d503","properties":{"control_id":"CM-7","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-cm-7-1b03e58f.json","targetId":"ctrl:nist-800-53:CM-7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a0ed3f7a22e09a000bd2147b3b7737fdd75d2a96a7639df6bcc9a9ec046c87cb","properties":{"control_id":"CM-6","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-cm-6-9bbade57.json","targetId":"ctrl:nist-800-53:CM-6","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ba5ee0286fc5f190afe59baf5c3c736973d100cbf11f4e3c3309d5c848f8950d","properties":{"control_id":"CM-2","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-cm-2-6be9ca0b.json","targetId":"ctrl:nist-800-53:CM-2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c5a0abd0f44091c916d1ebca5f3334bc24ef1624e00e5e6c020616c28f420451","properties":{},"sourceDetailPath":"/data/v1/records/wf-c42-b0991cdd.json","sourceId":"wf:C42","targetDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","targetId":"uc:UC-CONFIG-01","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c75fb9f029c35fe0c584fc4f281723d8cbe4aabe75e98fa71bf634bf6492967b","properties":{},"sourceDetailPath":"/data/v1/records/wf-c9-75fb1752.json","sourceId":"wf:C9","targetDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","targetId":"uc:UC-CONFIG-01","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e0de50edad858ee64dbfa7c6b722b4a0ea059889b3d392b46762ddf19273bcf0","properties":{"control_id":"A.8.9","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-9-616c4c1b.json","targetId":"ctrl:iso-27001:A.8.9","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fc5893a398befb9e8398d5b226f2e2a3c6b6847c478d429db61ecc678d2acf00","properties":{"rationale":"Enforcing secure configuration baselines reduces the cloud/IAM misconfigurations that break tenant isolation, though platform isolation is the operative defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/risk-net-cloud-multitenancy-exploit-d98521d5.json","targetId":"risk:net-cloud-multitenancy-exploit","type":"mitigates"}],"schemaVersion":1}