Governance Risk and Compliance

This refers to the level of control and constraints you have over users’ applications. It involves stopping software libraries, scripts, installers, and other executables from running on workstations.

This guideline refers explicitly to updating third-party applications. It focuses on applying security updates and patches as quickly as feasible. The strategies require frequent usage of vulnerability scanners to detect missing patches and updates, as well as removing solutions that are no longer supported by their vendors.

This strategy focuses on keeping operating systems up to date. The main outcome is to ensure that OS patches, updates, and security mitigations for internet-facing services are applied within two weeks of release – or within 48 hours if an exploit exists. Vulnerability scanners should be used to identify any missing patches, and any OS that is no longer vendor supported should be replaced.

Macro Settings: This refers to the amount of freedom your users have to run macros in Microsoft Office applications. Most users would have macros blocked as default – unless they have a demonstrated business requirement.

This refers to the limitations in place on users’ applications. At its most basic, web browsers should not be able to process ads or Java content from the internet, Internet Explorer 11 should be disabled, and users should not be able to change these settings.

This section involves enforcing MFA for all privileged access. Maturity starts by enforcing MFA for all user before they access internet-facing services and third-party providers.

This strategy involves ensuring critical systems and information is securely backed up and readily available. This flexible strategy requires organisations to back up important data, software, and configuration settings “in accordance with business continuity requirements”. All backup and restoration systems are tested, and unprivileged accounts restricted to their own backup environments.