PRO-04 · Protect

Secure configuration management

Systems (infrastructure, operating systems and applications) are securely configured to approved and maintained baselines, including by reducing attack surfaces and attack paths, with configurations continually monitored and consistently enforced.

Enterprise IT actions

• IT.PRO-04.1

  Define approved configuration baselines, informed by vendor and industry hardening guidance, that disable or remove unnecessary services, insecure settings, and unsupported or weak communication protocols.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  ASD’s indicators

  Not effective

  • No documented configuration baseline exists for assets.
  • Systems are deployed with vendor defaults and no documented hardening has been applied.

  Partially effective

  • A baseline exists but does not address all applicable asset types.
  • The baseline is documented but has not been reviewed or updated within the cycle defined by the organisation.
  • The baseline exists but rationale for configuration decisions is not documented.

  Fully effective

  • A documented and approved baseline exists for all applicable asset types.
  • The baseline disables or removes unnecessary services, insecure settings, and unsupported or weak communication protocols.
  • Configuration decisions are documented with rationale to support drift assessment.
  • The baseline is reviewed and updated on a cycle defined by the organisation.
  Related frameworks

  ISM

  ISM-0380, ISM-1409, ISM-1603, ISM-1914, ISM-1916

  NIST CSF 2.0

  PR.PS-01, PR.PS-02, PR.PS-03, PR.IR-01

  NIST SP 800-171r3

  03.04.02, 03.04.06, 03.04.01, 03.16.02

  AESCSF v2

  ASSET-3a, ARCHITECTURE-3d, ARCHITECTURE-3e, ASSET-3c

  Essential Eight

  Patch applications, Restrict administrative privileges, Restrict Microsoft Office macros, User application hardening

  MITRE ATT&CK

  T1505 Server Software Component, T1047 Windows Management Instrumentation, T1046 Network Service Discovery, T1003 OS Credential Dumping

  Rate this action in the Navigator →
• IT.PRO-04.2

  Deploy approved configuration baselines on systems, including infrastructure, operating systems and applications.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  ASD’s indicators

  Not effective

  • Approved baselines have not been applied to assets.
  • Baseline deployment has not been validated through technical assessment.

  Partially effective

  • Approved baselines have been implemented where available, but some relevant asset types are not covered by an approved baseline.
  • Deployment has occurred but validation through technical assessment is incomplete or not current.
  • Approved baselines have been deployed, but coverage for all applicable assets is inconsistent.

  Fully effective

  • Approved baselines have been applied to all applicable assets.
  • Deployment has been validated through technical assessment.
  • Coverage metrics are available demonstrating deployment completeness.
  Related frameworks

  ISM

  ISM-1246, ISM-1409, ISM-1635, ISM-1914

  NIST CSF 2.0

  PR.PS-01, PR.PS-02, PR.PS-05, DE.CM-09

  NIST SP 800-171r3

  03.04.01, 03.04.02, 03.04.03

  AESCSF v2

  ASSET-3b, ASSET-3c, ARCHITECTURE-3e

  Essential Eight

  Restrict Microsoft Office macros, User application hardening

  MITRE ATT&CK

  T1190 Exploit Public-Facing Application, T1133 External Remote Services, T1204 User Execution, T1059 Command and Scripting Interpreter

  Rate this action in the Navigator →
• IT.PRO-04.3

  Detect and respond to configuration drift using scheduled technical assessments and, where supported, automated monitoring, based on system criticality and change rate.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  ASD’s indicators

  Not effective

  • No mechanism exists to detect configuration drift from approved baselines.
  • Assessments to detect configuration drift have not been conducted within the review period defined by the organisation.
  • Assessments do not systematically identify instances of configuration drift for assets.

  Partially effective

  • Drift detection is in place but does not cover all applicable assets.
  • Drift is detected but the remediation process is informal or response timeframes are not defined.

  Fully effective

  • Automated configuration monitoring or regular technical assessments detect drift across the applicable assets, occurring at a frequency based on system criticality and change rate.
  • A documented remediation process exists with defined response timeframes aligned to severity.
  • Drift events are tracked to closure with evidence of remediation.
  Related frameworks

  ISM

  ISM-1211, ISM-1526

  NIST CSF 2.0

  PR.PS-01, DE.CM-09, DE.AE-02

  NIST SP 800-171r3

  03.04.03, 03.04.04, 03.12.03, 03.14.06

  AESCSF v2

  ASSET-3e, ASSET-4i

  Essential Eight

  Application control

  MITRE ATT&CK

  T1685 Disable or Modify Tools, T1112 Modify Registry

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Detect and respond to configuration changes within OT and its demilitarised zones, including changes to name resolution records, through automation or continuous technical assessment.

  • Phase 1Boundary services
  Rate this action in the Navigator →
• Action 2

  Define and deploy approved configuration baselines that disable or remove unnecessary physical ports, communications ports, services, insecure settings and weak protocols where systems support it, prevent unauthorised changes to name resolution records, monitor for access attempts against exposed services, and bring critical OT elements that can be updated to the same baseline as their IT equivalents.

  • Phase 1Boundary services, Critical processes and services
  • Phase 2Privileged environments
  Rate this action in the Navigator →
• Action 3

  Harden new instances of control software, including modelling, forecasting and automated decision support systems that provide input to control, where feasible, and where doing so does not degrade the availability or safety of the OT system.

  • Phase 1Critical processes and services
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Define approved configuration baselines for cloud services and tenant-level settings, informed by vendor and industry hardening guidance, that disable or remove unnecessary services, insecure settings and unsupported or weak protocols.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  • ResponsibilityPaaS: Supplied, SaaS: Provider
  Rate this action in the Navigator →
• Action 2

  Deploy approved configuration baselines across cloud services, preferring policy-as-code and preventative guardrails that block non-compliant configurations at deployment.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  • ResponsibilityPaaS: Provider, SaaS: Provider
  Rate this action in the Navigator →
• Action 3

  Detect and respond to configuration drift from approved configuration baselines using scheduled technical assessments and, where supported, automated monitoring, based on system criticality and change rate.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  • ResponsibilityPaaS: Supplied, SaaS: Provider
  Rate this action in the Navigator →

Open the Navigator →

More Protect principles

• PRO-01Secure system lifecycle
• PRO-05Secure administration
• PRO-06Vulnerability management
• PRO-07Trustworthy software
• PRO-08Cryptographic protection
• PRO-09Content filtering
• PRO-10Regular and proven backups
• PRO-12Least privilege access
• PRO-13Identity, credential and access management
• PRO-14Cyber security awareness training
• PRO-15Physical access control
• PRO-16Cyber supply chain security
• PRO-18Network segmentation and segregation
• PRO-19Operational technology isolation
• PRO-20Remote access to operational technology

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.