PW.9.1 Configure Software to Have Secure Settings by Default
Ship software with secure default configuration so that customers receive a secure posture out of the box. Document the security implications of any settings that customers can change.
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Telemetry on customer adoption of insecure settings · Document repository
periodic reviewEvidence produced at each review
- Default configuration review · Cloud console / configuration management
governing documentDocuments that govern the control
- Documentation of security implications of settings · Document repository
- Deprecation plan for unsafe defaults · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Document repository); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- secure defaults rolled back after customer complaint
- documentation does not call out security implications
- no measurement of how customers configure the product
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPW.8.2 Execute Security Testing · PW.9.2 Implement and Document Secure Defaults