PR.PS-01.240
Does your organization have a process to monitor software for deviations from approved baselines?
Explanation
Software baseline monitoring ensures that deployed applications maintain their approved configurations and security settings over time. Without regular monitoring, unauthorized changes or drift from secure configurations can introduce vulnerabilities or compliance issues.
Evidence could include documentation of a baseline monitoring system (such as configuration management tools), periodic compliance reports showing deviations from baselines, change detection logs, or screenshots of monitoring dashboards that track software configurations against established baselines.
Implementation Example
Monitor implemented software for deviations from approved baselines
ID: PR.PS-01.240
Context
- Function
- PR: PROTECT
- Category
- PR.PS: Platform Security
- Sub-Category
- Configuration management practices are established and applied
Related questions
- Has your organization established and maintained hardened baseline configurations for all systems that enforce security policies and provide only essential capabilities?
- Does your organization have a documented process for reviewing default configuration settings for security implications when installing or upgrading software?
- Does your organization implement and adhere to defined timeframes for routine and emergency patching as specified in your vulnerability management plan?
- Does your organization follow an immutable infrastructure approach for container deployments by replacing rather than updating existing container instances when updates are required?
- Does your organization have a process to identify and replace end-of-life software and services with supported versions?
- Does your organization have a process to identify, uninstall, and remove unauthorized software and services that pose security risks?
