CIS v8.1 · 4. Secure Configuration of Enterprise Assets and Software
CIS 4.8
Uninstall or Disable Unnecessary Services on Enterprise Assets and Software
frameworkCIS Controls v8.1
section4. Secure Configuration of Enterprise Assets and Software
csf 2.0PR.PS-01
topicsSecure Config
frameworks0 9 1
Official text · not licensableSafeguard title © CIS (CC BY-NC-ND 4.0). See CIS Controls v8.1 for details.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.PS-01 | Configuration management practices are established and applied | Editorial | Same topic: Secure Config (editorial pick) |
| ISO 27001 | A.8.9 | Configuration management | Editorial | Same topic: Secure Config (editorial pick)3 loosely related (not mappings) |
| SOC 2 | CC5.2CC7.1 | General controls over technology; Detecting configuration changes and new vulnerabilities | Editorial | Same topic: Secure Config (editorial pick) |
| PCI DSS | 2.2.12.2.2 | System configuration standards developed and maintained; Vendor default accounts managed or removed | Editorial | Same topic: Secure Config (editorial pick) |
| CMMC | CM.L2-3.4.1CM.L2-3.4.2CM.L2-3.4.6CM.L2-3.4.7 | System Baselining; Security Configuration Enforcement… | Editorial | Same topic: Secure Config (editorial pick)6 loosely related (not mappings) |
| 800-53 | CM-2CM-6CM-7 | Baseline Configuration; Configuration Settings… | Editorial | Same topic: Secure Config (editorial pick)8 loosely related (not mappings) |
| HIPAA | §164.310(d)§164.310(d)(2)(iii)§164.316(b)(2)(ii)§164.316(b)(2)(iii) | Device and Media Controls; Accountability… | No mapping. Only shares CSF PR.PS-01: related, not a mapping | |
| GDPR | Art.28(1) | Processor | No mapping. Only shares CSF PR.PS-01: related, not a mapping | |
| NIS2 | 6.3 | Configuration management | Editorial | Same topic: Secure Config (editorial pick) |
| Essential Eight | ISM-1412ISM-1585ISM-1621ISM-1654ISM-1859ISM-1860 | Web browsers are hardened using ASD and vendor hardening guidance, with the most…; Web browser security settings cannot be changed by human users… | Editorial | Same topic: Secure Config (editorial pick)25 loosely related (not mappings)ISM-1485 Web browsers do not process web advertisements from the internet Only shares CSF PR.PS-01: related, not a mapping ISM-1486 Web browsers do not process Java from the internet Only shares CSF PR.PS-01: related, not a mapping ISM-1487 Only privileged human users responsible for checking that Microsoft Office macros are… Only shares CSF PR.PS-01: related, not a mapping ISM-1488 Microsoft Office macros in files originating from the internet are blocked Only shares CSF PR.PS-01: related, not a mapping ISM-1489 Microsoft Office macro security settings cannot be changed by human users Only shares CSF PR.PS-01: related, not a mapping ISM-1542 Microsoft Office is configured to prevent activation of Object Linking and Embedding… Only shares CSF PR.PS-01: related, not a mapping ISM-1622 PowerShell is configured to use Constrained Language Mode Only shares CSF PR.PS-01: related, not a mapping ISM-1623 PowerShell module logging, script block logging and transcription events are centrally… Only shares CSF PR.PS-01: related, not a mapping …and 17 more in the downloads |
| DORA | Art.28(8)Art.30(2) | General principles; Key contractual provisions | No mapping. Only shares CSF PR.PS-01: related, not a mapping | |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | CE 2 | Secure Configuration | Editorial | Same topic: Secure Config (editorial pick)1 loosely related (not mappings) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.