Requirement
To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
Points of Focus
Uses Defined Configuration Standards
Requirement: The entity has defined configuration standards to be used for hardening systems.
Monitors Infrastructure and Software
Requirement: The entity monitors infrastructure and software for noncompliance with the standards, which could threaten the achievement of the entity's objectives.
Implements Change-Detection Mechanisms
Requirement: The IT system includes a change-detection mechanism (for example, file integrity monitoring tools) to alert personnel to unauthorized modifications of critical system files, configuration files, or content files.
Detects Unknown or Unauthorized Components
Requirement: Procedures are in place to detect the introduction of unknown or unauthorized components.
Conducts Vulnerability Scans
Requirement: The entity conducts infrastructure and software vulnerability scans designed to identify potential vulnerabilities or misconfigurations on a periodic basis and after significant changes are made to the environment. Action is taken to remediate identified deficiencies in a timely manner to support the achievement of the entity’s objectives.
Explanation
Systems drift out of their secure configuration over time, and new vulnerabilities are discovered constantly. This criterion requires hardening standards, vulnerability scanning, and change-detection tooling so weaknesses are found before attackers exploit them. Auditors look for defined configuration baselines, periodic scan results, and evidence that identified deficiencies are remediated in a timely manner.
