2.1.1Processes and mechanisms for applying secure configurations to all system components are defined and understood

Defined Approach Requirements:

All security policies and operational procedures that are identified in Requirement 2 are:

- documented.

- kept up to date.

- in use.

- known to all affected parties.

Defined Approach Testing Procedures:

2.1.1 Examine documentation and interview personnel to verify that security policies and operational procedures identified in Requirement 2 are managed in accordance with all elements specified in this requirement.