Commit 4effa2a6 authored by Liz Coleman's avatar Liz Coleman
Browse files

update control wording

parent a4a0ec9d
Pipeline #170585061 skipped with stage
......@@ -13,16 +13,16 @@ title: "CFG.1.01 - Baseline Configuration Standard Control Guidance"
 
## Control Statement
 
GitLab ensures security hardening and baseline configuration standards have been established according to industry standards and are reviewed and updated quarterly.
A configuration management tool is utilized for security hardening and baseline configuration standards have been established on production servers.
 
## Context
 
Baseline hardening standards make it clear how systems should be hardened and configured. To ensure we these standards are always relevant, we need to regularly review these documents and update them as needed. The goal of this control is to remove as much subjectivity as possible from the process of configuring systems. If we create a standard for each system type within GitLab, it will be easier to automate system configuration and ensure that all systems are configured the same. This consistent configuration becomes critical when critical vulnerabilities are discovered and need to be rapidly deployed to all applicable systems.
This control should be tested to ensure GitLab has established a standardized policy, procedure and guidelines documentation in the handbook, that follows through with the industry standards for Baseline system configurations. It should also be tested to see if these standards documentation were reviewed and updated quarterly.
Baseline configuration standards make it clear how systems should be hardened and configured. To ensure these standards are always relevant, we need to regularly review these documents and update them as needed. The goal of this control is to remove as much subjectivity as possible from the process of configuring systems. If we create a standard for each system type within GitLab, it will be easier to automate system configuration and ensure that all systems are configured the same. This consistent configuration becomes critical when critical vulnerabilities are discovered and need to be rapidly deployed to all applicable systems.
This control should be tested to ensure the configuration management tool that GitLab has established is utilized 100% of the time for security hardening and baseline configuration standards on produciton servers.
 
## Scope
 
This control applies to all systems within our production environment and team member laptops. The production environment includes all endpoints and cloud assets used in hosting GitLab.com and its subdomains. This may include third-party systems that support the business of GitLab.com.
This control applies to all systems within our production environment. The production environment includes all endpoints and cloud assets used in hosting GitLab.com and its subdomains. This may include third-party systems that support the business of GitLab.com.
 
## Ownership
 
......@@ -54,8 +54,6 @@ Examples of evidence an auditor might request to satisfy this control:
 
## Framework Mapping
 
* ISO
* A.12.5.1
* SOC2 CC
* CC7.1
* CC7.2
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment