[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fcm-6":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","cm-6","CM-6","Configuration Settings",315,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must establish and document secure configuration settings for system components, reflecting the most restrictive mode consistent with operations, implement them, document approved deviations and monitor for unauthorised changes.\n\n**In practice.** This means adopting hardening benchmarks such as the CIS Benchmarks for operating systems, cloud services and applications, enforcing them through group policy, configuration management or cloud policy tools, and checking compliance continuously. Auditors expect the chosen baselines, compliance scan results, and a register of approved exceptions. CIS Control 4 and ISO\u002FIEC 27001 configuration management cover the same idea.\n\n**Common gaps.** Organisations frequently define baselines but do not measure drift, or apply them only to new builds. SaaS and cloud tenant settings are often left at vendor defaults.","a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: organization-defined common secure configurations];\n  b. Implement the configuration settings;\n  c. Identify, document, and approve any deviations from established configuration settings for [Assignment: organization-defined system components] based on [Assignment: organization-defined operational requirements] ; and\n  d. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.\nDiscussion: Configuration settings are the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system. Information technology products for which configuration settings can be defined include mainframe computers, servers, workstations, operating systems, mobile devices, input\u002Foutput devices, protocols, and applications. Parameters that impact the security posture of systems include registry settings; account, file, or directory permission settings; and settings for functions, protocols, ports, services, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including the parameters required to satisfy other privacy controls. Privacy parameters include settings for access controls, data processing preferences, and processing and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the configuration baseline for the system.\n\nCommon secure configurations (also known as security configuration checklists, lockdown and hardening guides, and security reference guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for information technology products and platforms as well as instructions for configuring those products or platforms to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, federal agencies, consortia, academia, industry, and other organizations in the public and private sectors.\n\nImplementation of a common secure configuration may be mandated at the organization level, mission and business process level, system level, or at a higher level, including by a regulatory agency. Common secure configurations include the United States Government Configuration Baseline [USGCB](#98498928-3ca3-44b3-8b1e-f48685373087) and security technical implementation guides (STIGs), which affect the implementation of [CM-6](#cm-6) and other controls such as [AC-19](#ac-19) and [CM-7](#cm-7) . The Security Content Automation Protocol (SCAP) and the defined standards within the protocol provide an effective method to uniquely identify, track, and control configuration settings.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"critical-drupal-rce-flaws-demand-immediate-patching","Critical Drupal RCE Flaws Demand Immediate Patching","2026-10-17T16:20:34.593+00:00",{"slug":25,"title":26,"published_at":27},"unpatched-collabora-rce-flaw-lets-attackers-backdoor-nextcloud-servers","Unpatched Collabora RCE Flaw Lets Attackers Backdoor Nextcloud Servers","2026-10-15T22:20:38.386+00:00",{"slug":29,"title":30,"published_at":31},"critical-rce-dns-wallet-theft-container-escape-self-healing-malware-highlight-diverse-threat-week","Critical RCE, DNS Wallet Theft, Container Escape & Self-Healing Malware Highlight Diverse Threat Week","2026-10-15T20:20:52.553+00:00",{"slug":33,"title":34,"published_at":35},"nginx-patches-rce-and-tls-auth-bypass-flaws-including-a-20-year-old-bug","NGINX Patches RCE and TLS Auth Bypass Flaws — Including a 20-Year-Old Bug","2026-10-15T16:21:08.659+00:00",{"slug":37,"title":38,"published_at":39},"vibetech-exposes-137m-records-in-unsecured-database","Vibetech Exposes 13.7M Records in Unsecured Database","2026-10-15T16:20:19.435+00:00",{"slug":41,"title":42,"published_at":43},"pan-os-zero-day-enables-root-level-rce-on-firewalls","PAN-OS Zero-Day Enables Root-Level RCE on Firewalls","2026-10-15T08:20:33.588+00:00",{"slug":45,"title":46,"published_at":47},"windows-update-breaks-remote-desktop-for-non-admin-users","Windows Update Breaks Remote Desktop for Non-Admin Users","2026-10-14T12:21:33.608+00:00",{"slug":49,"title":50,"published_at":51},"114-vulnerabilities-patched-in-chrome-and-firefox-update-immediately","114 Vulnerabilities Patched in Chrome and Firefox — Update Immediately","2026-10-14T08:20:17.574+00:00",{"slug":53,"title":54,"published_at":55},"microsoft-patches-record-1413-flaws-including-actively-exploited-shell-bug","Microsoft Patches Record 1,413 Flaws Including Actively Exploited Shell Bug","2026-10-14T06:20:31.76+00:00",{"slug":57,"title":58,"published_at":59},"npm-trusted-publishing-flaw-exposed-1500-packages-to-hijacking","npm Trusted Publishing Flaw Exposed 1,500+ Packages to Hijacking","2026-10-13T18:21:16.112+00:00",{"slug":61,"title":62,"published_at":63},"four-year-old-gpu-flaw-enables-fire-tv-cube-rooting","Four-Year-Old GPU Flaw Enables Fire TV Cube Rooting","2026-10-13T12:22:37.618+00:00",{"slug":65,"title":66,"published_at":67},"gitlab-cvss-100-rce-flaw-exposes-servers-to-unauthenticated-code-execution","GitLab CVSS 10.0 RCE Flaw Exposes Servers to Unauthenticated Code Execution","2026-10-13T10:21:03.021+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"patch-management","Automated patch management","Known holes get closed in days, not months.",190,{"slug":75,"name":76,"problem":77,"stories":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",171,{"slug":80,"name":81,"problem":82,"stories":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",98,{"slug":85,"name":86,"problem":87,"stories":88},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",45,{"slug":90,"name":91,"problem":92,"stories":93},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",39,{"slug":95,"name":96,"problem":97,"stories":98},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",36,[100,106,111,116,121,126,132,138],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","7","Control 7","Continuous Vulnerability Management",231,{"family":5,"item":107,"code":108,"title":109,"together":110},"si-2","SI-2","Flaw Remediation",201,{"family":101,"item":112,"code":113,"title":114,"together":115},"4","Control 4","Secure Configuration of Enterprise Assets and Software",193,{"family":117,"item":118,"code":119,"title":119,"together":120},"itil","overview","ITIL",185,{"family":101,"item":122,"code":123,"title":124,"together":125},"12","Control 12","Network Infrastructure Management",150,{"family":127,"item":128,"code":129,"title":130,"together":131},"gdpr","32","Article 32","Security of processing",105,{"family":133,"item":134,"code":135,"title":136,"together":137},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",84,{"family":5,"item":139,"code":140,"title":141,"together":142},"ra-5","RA-5","Vulnerability Monitoring and Scanning",83]