Does your organization have a documented process for reviewing default configuration settings for security implications when installing or upgrading software?

Default configurations in software often prioritize usability over security, potentially leaving systems vulnerable to attacks. This review process should identify and modify insecure default settings such as default credentials, unnecessary open ports, excessive permissions, or enabled but unneeded features that expand the attack surface. Evidence could include a formal configuration review checklist or procedure document, screenshots of configuration management tools, or documentation showing before/after configuration settings with security-focused changes highlighted during recent software deployments.