CFG.1.01_baseline_configuration_standard.html.md 3.04 KB
Newer Older
1
---
2
layout: handbook-page-toc
3
title: "CFG.1.01 - Baseline Configuration Standard Control Guidance"
4 5 6
---

## On this page
7
{:.no_toc .hidden-md .hidden-lg}
8 9

- TOC
10
{:toc .hidden-md .hidden-lg}
11

12
# CFG.1.01 - Baseline Configuration Standard
13 14 15

## Control Statement

Liz Coleman's avatar
Liz Coleman committed
16
A configuration management tool is utilized for security hardening and baseline configuration standards have been established on production servers.
17 18 19

## Context

Liz Coleman's avatar
Liz Coleman committed
20 21
Baseline configuration standards make it clear how systems should be hardened and configured.  To ensure these standards are always relevant, we need to regularly review these documents and update them as needed.  The goal of this control is to remove as much subjectivity as possible from the process of configuring systems.  If we create a standard for each system type within GitLab, it will be easier to automate system configuration and ensure that all systems are configured the same. This consistent configuration becomes critical when critical vulnerabilities are discovered and need to be rapidly deployed to all applicable systems.
This control should be tested to ensure the configuration management tool that GitLab has established is utilized 100% of the time for security hardening and baseline configuration standards on produciton servers.
22 23 24

## Scope

Liz Coleman's avatar
Liz Coleman committed
25
This control applies to all systems within our production environment. The production environment includes all endpoints and cloud assets used in hosting GitLab.com and its subdomains. This may include third-party systems that support the business of GitLab.com.
26 27 28

## Ownership

Luka Trbojevic's avatar
Luka Trbojevic committed
29 30
* Control Owner: `Security`
* Process owner(s):
31 32 33
    * Infrastructure
    * IT Ops
    * Security
Luka Trbojevic's avatar
Luka Trbojevic committed
34
    
35
## Guidance
36

37
*  The related pages in the handbook listed below in the Policy reference section, can be more comprehensive, covering all details including all OS hardening guidelines, For ex:Linux hardening guide, etc
38 39
*  We don't have to reinvent the wheel with these. Whenever possible we should be referencing industry standards for system configurations (e.g., NIST guidelines).

40

41
## Additional control information and project tracking
42

Jeff Burrows's avatar
Jeff Burrows committed
43
Non-public information relating to this security control as well as links to the work associated with various phases of project work can be found in the [Baseline Configuration Standard control issue](https://gitlab.com/gitlab-com/gl-security/compliance/compliance/issues/784).
44

45 46 47 48 49
Examples of evidence an auditor might request to satisfy this control:

* Configuration standards, guides, Chef cookbooks, and Terraform configs.
* Documentations showing the configuration standards are consistently applied.

Luka Trbojevic's avatar
Luka Trbojevic committed
50
### Policy Reference
emilie's avatar
emilie committed
51
* [Laptop or Desktop System configuration](/handbook/security/#laptop-or-desktop-system-configuration)
Lis Vinueza's avatar
Lis Vinueza committed
52
* [Configuring New Laptops](/handbook/business-ops/team-member-enablement/onboarding-access-requests/#configuring-new-laptops--apple-ids)
emilie's avatar
emilie committed
53
* [Security Best Practices](/handbook/security/#best-practices)
Luka Trbojevic's avatar
Luka Trbojevic committed
54

55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73
## Framework Mapping

* SOC2 CC
  * CC7.1
  * CC7.2
* PCI
  * 1.1
  * 1.1.4
  * 1.1.6
  * 1.2
  * 1.2.2
  * 2.1
  * 2.1.1
  * 2.2
  * 2.2.2
  * 2.2.3
  * 2.2.4
  * 2.2.5
  * 5.3