Has your organization established and maintained hardened baseline configurations for all systems that enforce security policies and provide only essential capabilities?

Hardened baselines are standardized, security-focused configurations that remove unnecessary services, close security gaps, and ensure systems operate with minimal attack surface. These baselines should be thoroughly tested before deployment, regularly updated, and consistently applied across your environment to enforce the principle of least functionality.

Evidence could include documentation of your baseline configuration standards, change management records showing baseline updates, automated configuration management reports, or results from compliance scanning tools that verify systems adhere to established baselines.