3.4.2
3.4.2
Establish and enforce security configuration settings for information technology products employed in organizational systems.
-
5.4.2.1 The organization shall implement secure configurations for all their devices by:
a) changing all default passwords.5.4.3.1 The organization shall implement secure configurations for all their devices unless it is impossible to do so on a specific device:
a) by turning off unnecessary features i.e., block unused ports, disable unused services, remove unused or obsolete software; and
b) by enabling all relevant security features.