What it asks for. This category asks that the hardware, software and services of physical and virtual platforms are managed in line with the risk strategy. It covers configuration management, software maintenance and replacement, hardware lifecycle, log generation, preventing unauthorised software and integrating secure development practices.
In practice. Good practice is approved secure configuration baselines for operating systems, cloud services and network devices, with drift detected and corrected. Patching follows risk-based timelines, unsupported software and hardware are replaced, and only authorised software can run. Systems generate logs suitable for monitoring, and software is built using secure development practices. Evidence includes baseline documents, configuration compliance scans, patch reports, end-of-life registers and application control policies.
Common gaps. Organisations often lack baselines for cloud and SaaS platforms, carry end-of-life systems without a plan, and allow uncontrolled software installation. Logging is frequently enabled by default settings rather than designed for detection needs.