PR.PS-01 Configuration management
Establishing and applying configuration management: hardened baselines under least functionality, review of default settings at install or upgrade, and monitoring for deviations from baselines.
PR.PS Platform security
Platform Security: configuration management, software and hardware maintenance, log generation, preventing unauthorized software and secure software development; six Subcategories.
PR.PS-02 Software maintenance and removal
Maintaining, replacing and removing software by risk: patching within defined timeframes, replacing container instances, retiring end-of-life versions and removing unauthorized or unnecessary software.
PR.PS-03 Hardware maintenance and disposal
Maintaining, replacing and removing hardware by risk: replacing hardware that lacks security capabilities, planning end-of-life support and disposing of hardware securely and auditably.
PR.PS-04 Log generation
Generating log records across operating systems, applications and cloud services and sending them securely to logging infrastructure so they are available for continuous monitoring.
PR.PS-05 Unauthorized software prevented
Preventing installation and execution of unauthorized software through allowlisting or denylisting, source and integrity checks, protective DNS and approved-software-only installation.
PR.PS-06 Secure software development
Integrating secure development practices across the software development life cycle and monitoring their performance, from protecting code from tampering to releasing software with minimal vulnerabilities.
