NIST 800-53 rev.5/System and Services Acquisition/649 of 1011
SA-04 (05)Acquisition Process | System, Component, and Service Configurations
Control family: System and Services Acquisition
Control description
Require the developer of the system, system component, or system service to:
(a) Deliver the system, component, or service with [Assignment: organization-defined security configurations] implemented; and
(b) Use the configurations as the default for any subsequent system, component, or service reinstallation or upgrade.
How to implement
Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.