Information Security Handbook

Step 2: Developing secure configuration baselines

Develop secure configuration baselines based on industry best practices, such as:

• Center for Internet Security (CIS): https://www.cisecurity.org/
• Defense Information Security Agency (DISA): https://iase.disa.mil

These organizations have developed detailed guidance, benchmarks, and procedures that explain the available security configuration options for a large range of applications, services, and operating systems.

The guidance contained within these documents includes:

• Enabling best practice security-related configurations
• Removal of unneeded accounts
• Removal or disabling of unneeded services

The guidance, benchmarks, and procedures that you select should be tested to meet your organization's ...