2-13. arizona_baseline_security_controls_pre-requisite__0_0_Equifax Response.xlsx

NIST 800-53 r4 controls

[Control and Control Enhancement]

Implementation Status (Reference on Comments Page )

Documentation

(If you can't meet this control at all please explain why)

The organization:

a. Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];

b. Assigns account managers for information system accounts;

c. Establishes conditions for group and role membership;

d. Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

e. Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;

f. Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];

g. Monitors the use of, information system accounts;

h. Notifies account managers:

1. When accounts are no longer required;

2. When users are terminated or transferred; and

3. When individual information system usage or need-to-know changes;

i. Authorizes access to the information system based on:

1. A valid access authorization;

2. Intended system usage; and

3. Other attributes as required by the organization or associated missions/business functions;

j. Reviews accounts for compliance with account management requirements [At least annually]; and

k. Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

Equifax / Insights meets the control AC-2. Overall, though we are not like-to-like in the controls that reference NIST SP 800-53, we map to the NIST 800-53 controls in this document. Equifax/Insights uses a NIST CSF standard, mapping to ISO27001 and most of NIST 800-53, to CIS, and others, just to name a few. In this way Equifax / Insights provides depth in defense that supports industry leading security.

The Equifax/Insights Information Security Program is based on the NIST Cybersecurity Framework ("CSF") and NIST Privacy Framework ("PF") and documented in Equifax's Information Security Policy, which is supported by controls and technical requirements that operate together. The defense-in-depth security and privacy strategy and is meant to be a flexible, risk-based structure that is adapted to a company's specific needs. The framework's structure is focused around five core functions (Identify, Protect, Detect, Respond, and Recover), each consisting of categories and subcategories that help an organization organize and standardize its security and privacy controls.

(I) the organization manages information system accounts, including authorizing, establishing, activating, modifying, reviewing, disabling, and removing accounts;

(ii) the organization defines in the security plan, explicitly or by reference, the frequency of information system account reviews and the frequency is at least annually;

(iii) the organization reviews information system accounts in accordance with organization-defined frequency; and

(iv) the organization initiates required actions on information system accounts based on the review.

(v) determine if the organization employs automated mechanisms to support information system account management functions.

(vi) the organization defines in the security plan, explicitly or by reference, a time period for each type of account after which the information system terminates temporary and emergency accounts; and

(vii) the information system automatically terminates temporary and emergency accounts after organization-defined time period for each type of account.

(viii) the organization defines in the security plan, explicitly or by reference, a time period after which the information system disables inactive accounts; and

(ix) the information system automatically disables inactive accounts after organization-defined time period.

(x) the organization employs automated mechanisms to audit account creation, modification, disabling, and termination actions; and

(xi) the organization employs automated mechanisms to notify, as required, appropriate individuals.

Are information systems (applications, operating systems, network devices, databases, etc.) configured and access enforcement mechanisms employed per approved policy to provide protection from unauthorized access by malicious users, software or systems? Obtain access control policy; procedures addressing access enforcement; information system configuration settings and associated documentation; list of assigned authorizations (user privileges); information system audit records; other relevant documents or records and ascertain if

(I) the information system enforces assigned authorizations for controlling access to the system in accordance with applicable policy; and

Equifax / Insights uses access control policies control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. In addition to enforcing authorized access at the system level and recognizing that systems can host many applications and services in support of mission and business functions, access enforcement mechanisms can also be employed at the application and service level to provide increased information security and privacy. In contrast to logical access controls that are implemented within the system, physical access controls are addressed by the controls in the Physical and Environmental Protection (PE) family. Does the institution or department have policies and supporting processes in place:

1) to "authorize" and regulate connections to and from applicable information systems, and [Note: supporting processes can include security considerations when interfaces are created to and from the information system; controlling administrative type access that can enable interface accounts, etc.].

2) to restrict and control the allocation and use of administrative access to information systems?

a. Separates [Assignment: organization-defined duties of individuals];

b. Documents separation of duties of individuals; and

(I) the organization establishes appropriate divisions of responsibility and separates duties as needed to eliminate conflicts of interest in the responsibilities and duties of individuals; and

Equifax / Insights meets the control AC-6. Equifax / Insights employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks. Has the institution or department established and implemented procedures to restrict system access to only authorized personnel based on need to know and to other information systems based on business function requirements? [Note the organization may need to control access to facilities, information inside applications, software programs for testing and revision.] Obtain access control policy; procedures addressing least privilege; list of assigned access authorizations (user privileges); information system configuration settings and associated documentation; information system audit records; other relevant documents or records and ascertain if

(I) the organization assigns the most restrictive set of rights/privileges or accesses needed by users for the performance of specified tasks; and

a. Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and

b. Authorizes remote access to the information system prior to allowing such connections.

Remote access to organizational systems (or processes acting on behalf of users) that communicate through external networks such as the Internet are managed. Types of remote access include broadband, and wireless. We use encrypted virtual private networks (VPNs) enhances confidentiality and integrity for remote connections. The use of encrypted VPNs provides sufficient assurance to effectively treat such connections as internal networks since the cryptographic mechanisms used are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and NIST guidelines for ciphers. Authorization of each remote access type addresses authorization prior to allowing remote access. Enforcing access restrictions for remote access is addressed via AC-3. Does the institution or department have policies and processes in place for:

(i) providing secure remote access to information systems, including rules on when privileged access is provided,

(ii) monitoring and authorizing remote access to information systems, and

(iii) enforcing requirements for remote connections to the information system in place?

[Note: Documentation on methods should also include usage restrictions and implementation guidance for each allowed remote access method; secure remote connections include proper configuration and use of encryption; example of privileged remote access include approval(s) required based on business need, and use of stronger authentication such as two-factor]. Obtain access control policy; procedures addressing remote access to the information system; information system configuration settings and associated documentation; information system audit records; other relevant documents or records and ascertain if

(I) the organization authorizes, monitors, and controls remote access to the information system for all allowed methods of remote access to include both establishment of the remote connection and subsequent user actions across that connection.

(ii) the information system employs automated mechanisms to facilitate the monitoring and control of remote access methods.

(iii) the information system employs cryptography to protect the confidentiality and integrity of remote access sessions.

a. Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and

b. Authorizes wireless access to the information system prior to allowing such connections.

. We use a centralized wireless system from Aruba. Our configuration is a centralized point of encryption with "thin" access points that tunnel the wireless frames over the corporate network to the controller where encryption/decryption/firewall activities are performed. We allow two SSID's, one which only offers Internet access after authentication with AD credentials over HTTPS, a second SSID which uses WPA2/EAP-TLS/AES (discussed further below) with client side certificate for corporate network equivalent access. Two-factor authentication is required for access outside corporate segments. Locations permitting wireless are limited and controlled. Locations require the need for Aruba equipment to be installed and managed locally and 802.1x certificate authentication. Computers registered on the domain are issued a digital certificate that is inspected for machine authentication (MAC address via ACL) to local access points. Using the existing digital certificate assigned to the device, a session key is generated using WPA2 Enterprise AES 256 encryption. Session traffic and corresponding logs are routed automatically to the Cyber Threat Center for review of suspicious or anomalous traffic. Aruba has a Wireless Intrusion Detection Systems that will search for rogue devices in real-time. We do not use wireless networking technology within our application / server environment. Are wireless device(s) and access point(s) securely managed through:

(i) a defined and effective process for authorizing the setting up of wireless access points;

(ii) a defined and documented standard for configuring wireless access points for security;

(iii) having in place a process to regularly review wireless access points for proper configuration and rogue wireless access points; and

(iv) having a defined architecture where wireless access points are properly segregated from wired network (e.g., use of Firewalls)?

Obtain access control policy; procedures addressing wireless implementation and usage (including restrictions); NIST Special Publications 800-48 and 800-97; activities related to wireless authorization, monitoring, and control; information system audit records; other relevant documents or records and ascertain if

(I) the organization establishes usage restrictions and implementation guidance for wireless technologies;

(ii) the organization authorizes, monitors, and controls wireless access to the information system; and

(iii) the wireless access restrictions are consistent with NIST Special Publications 800-48 and 800-97.

a. Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and

b. Authorizes the connection of mobile devices to organizational information systems.

The company has established usage restrictions of mobile devices within the environment by prohibiting their use within the environment. Usage restrictions and specific implementation guidance for mobile devices include configuration management, device identification and authentication, implementation of mandatory protective software, scanning devices for malicious code, updating virus protection software, scanning for critical software updates and patches, conducting primary operating system (and possibly other resident software) integrity checks, and disabling unnecessary hardware. Usage restrictions and authorization to connect vary. Adequate security for mobile devices goes beyond the requirements specified in AC-19; many safeguards for mobile devices are reflected in other controls. We do not use mobile / wireless networking technology within our application / server environment. Are there documented policies, standards, and procedures in place for addressing and enforcing security related to usage of mobile devices (e.g., USB drives, PDAs, Smart Phones, tablets, etc.), including Bring Your Own Device (BYOD)?

[Note: Example controls include: policies that define how such devices are used in context of business; and technical controls such as password requirements to access the device, use of "containers" to segregate confidential information, use of encryption on containers, remote wipe-out capabilities for PDAs/Smartphones, etc.] Obtain access control policy; procedures addressing access control for portable and mobile devices; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records and ascertain if

(I) the organization establishes usage restrictions and implementation guidance for organization-controlled portable and mobile devices; and

a. As part of initial training for new users;

b. When required by information system changes; and

c. [Assignment: organization-defined frequency] thereafter.

The Security Team requires all employees and contingent workers to complete basic security awareness training as part of the onboarding process and annually thereafter. The Security Team requires all new Equifax employees and contingent workers to undergo basic security awareness training within 30 days of start date as part of the onboarding process. The corporate Learning Management System (LMS) security awareness training. The LMS is managed in Workday, which is managed by the Equifax Global HR Talent Management. The training uses a combination of audio, video, text, and interactivities methods. The training covers several security topics to include:

Offline Threats and Vulnerabilities – Physical Security Offline Threats and Vulnerabilities – Social Engineers Phishing Online Threats and Vulnerabilities – Malware Online Threats and Vulnerabilities – Password Management Acceptable Use Policies; and Incident Response

Also included are training modules that recognize potential indicators of insider threats and how to report it. This module is included in both the onboarding and annual security awareness training. Equifax incorporates internal experiences of employees as well as external news and information into its Security Awareness Training programs. It covers topics like phishing, vishing, and pulls from real world examples to explore the concepts and tactics used by adversaries. The organization will also conduct ad-hoc updates to employees if required.

All Equifax personnel and contingent workers must successfully complete or demonstrate comprehensive via a minimum of 80% pass rate to meet the requirement. Failure to do so will result in the employee being required to retake the training and comprehension test. Employee’s direct manager is responsible for ensuring the required annual security training is completed successfully. 1. Does the institution or department provide on-going basic security awareness training to all information system users (including department heads, senior executives, and contractors)? Are awareness and training materials updated periodically for addressing relevant security behaviors of the current time based on industry trends, past incidents, etc., as well as indicators of insider threat?

2. Does the organization have targeted training in place for positions with higher risk profile (e.g., system administrators, personnel with access to student records, etc.? Obtain Security awareness and training policy; procedures addressing security awareness training implementation; NIST Special Publication 800-50; appropriate codes of federal regulations; security awareness training curriculum; security awareness training materials; security plan; other relevant documents or records and ascertain if (I)the organization provides basic security awareness training to all information system users (including managers and senior executives) before authorizing access to the system and when required by system changes;

(ii)the security awareness training is consistent with applicable regulations and NIST Special Publication 800-50;

(iii)the security awareness and training materials address the specific requirements of the organization and the information systems to which personnel have authorized access;

(iv)the organization defines in the security plan, explicitly or by reference, the frequency of refresher security awareness training and the frequency is at least annually.

a. Reviews and analyzes information system audit records [Assignment: organization-defined frequency] for indications of Parameter: [at least weekly]; and

b. Reports findings to [Assignment: organization-defined personnel or roles].

The CIRT and Application/System Owner(s) review and analyze audit records, as defined in AU-2, continuously for inappropriate or unusual activity using monitoring and alerts. Logs generate alerts according to configured event criteria and are sent to the SIEM. The CIRT Team uses customizable dashboards within SIEM and Demisto (XSOAR) to review and analyze records. Alerts are generated on any anomalous activity based on certain events or thresholds configured within the SIEM.

(I)the organization regularly reviews/analyzes audit records for indications of inappropriate or unusual activity;

(ii)the organization investigates suspicious activity or suspected violations;

(iii)the organization reports findings of inappropriate/unusual activities, suspicious behavior, or suspected violations to appropriate officials; and (iv)the organization takes necessary actions in response to the reviews/analyses of audit records

a. Provides audit record generation capability for the auditable events defined in AU-2 a. at [all information system and network components where audit capability is deployed/available]

b. Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and

c. Generates audit records for the events defined in AU-2 d. with the content defined in AU-3. The environment leverages logging to collect and forward the the logs to the SIEM solution, and logging agents forward server and application logs. For the service, servers and applications are configured to log activity that can enable the monitoring, reporting, analysis, and investigation of unlawful, unauthorized, or inappropriate information system activity. Logged events include:

Authentication (e.g., successful and failed logon and logoff) Authorization (e.g., successful and failed access) User or group management, including:

Account creation or modification Group creation or modification Password creation or modification Changes to authentication and authorization mechanisms Modification, initialization, stopping, or pausing of the audit logs Process creation System operational events

The following details are captured where possible:

Date and time stamp Type of event User identifier Source and Destination IP address Destination port Layer 4 protocol Layer 7 protocol User Agent String Session or activity duration Bytes sent and received Terminal address and location Activity type attempted (e.g., login, login help, update, delete, insert, create, file upload/download) Activity success or failure Before and after values Identity or name of affected data, system component, or resource

Administrators within the CIRT team have privileges to select auditable events are to be audited by specific components of the company system.

The CIRT ensures that the corporate components generate a sufficient amount of information with audit records produced. The SIEM ensures that all audit logs contain the following information:

Authentication (e.g., successful and failed logon and logoff) Authorization (e.g., successful and failed access) User or group management, including:

Account creation or modification Group creation or modification Password creation or modification Changes to authentication and authorization mechanisms Modification, initialization, stopping, or pausing of the audit logs Process creation System operational events

The following details are captured where possible:

Date and time stamp Type of event User identifier Source and Destination IP address Destination port Layer 4 protocol Layer 7 protocol User Agent String Session or activity duration Bytes sent and received Terminal address and location Activity type attempted (e.g., login, login help, update, delete, insert, create, file upload/download) Activity success or failure Before and after values Identity or name of affected data, system component, or resource Does the institution or department have a documented logging standard that defines the minimum requirements for logging (e.g., fields to log, type of events, log protection requirements, retention requirements, etc.)? Obtain audit and accountability policy; procedures addressing audit record generation; security plan; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records and ascertain if :

(I) the organization defines the information system components that provide audit record generation capability for the list of auditable events defined in AU-2;

(ii) the information system provides audit record generation capability, at organization-defined information system components, for the list of auditable events defined in AU-2;

(iii) the information system allows designated organizational personnel to select which auditable events are to be audited by specific components of the system; and

a. Develops a security assessment plan that describes the scope of the assessment including:

1. Security controls and control enhancements under assessment;

2. Assessment procedures to be used to determine security control effectiveness; and

3. Assessment environment, assessment team, and assessment roles and responsibilities;

b. Assesses the security controls in the information system and its environment of operation[at least annually] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

c. Produces a security assessment report that documents the results of the assessment; and

d. Provides the results of the security control assessment to [individuals or roles to include ADOA/ASET].

The company periodically assesses the adequacy of the Information Security Management Program and supporting safeguards. The company will respond to assessment requests on all security controls and control enhancements. The company will make available its Security Plan (SSP), called the Security Controls Framework, as supporting documents to support the scope of the security assessment and authorization activities in accordance company guidance and requirements. The company develops a continuous monitoring strategy and implements a continuous monitoring program to periodically assess adequacy of safeguards deployed. Assessments are performed by individuals with appropriate levels of independence and coordinated with other assessment and audit functions, as appropriate. This Security Controls Framework is consistent with the enterprise architecture, documents authorization boundaries, provides security requirements / controls, is approved by an authorizing official at least annually. Annually, Independent, third-party, nationally recognized vendors conduct audits of the SSP / Security Controls Framework; results are provided through the Complaince Portal. Does the institution or department have a defined information security program that includes:

i) developing a plan and executing periodic assessments of security control effectiveness;

ii) identifying objective and qualified assessors; and iiI) reporting results of such assessment(s) to the appropriate stakeholders?

Obtain security assessment policy; procedures addressing security assessments; security plan; security assessment plan; security assessment report; assessment evidence; security authorization package (including security plan, security assessment report, plan of action and milestones, authorization statement); other relevant documents or records and ascertain if :

(I)the organization defines in the security plan, explicitly or by reference, the frequency of security control assessments and the frequency is at least annually (ii)the organization conducts an assessment of the security controls in the information system at an organization-defined frequency.

a. Establishment of [Assignment: organization-defined metrics] to be monitored;

b. Establishment of [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessments supporting such monitoring;

c. Ongoing security control assessments in accordance with the organizational continuous monitoring strategy;

d. Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; [To meet State of Arizona's requirements]

e. Correlation and analysis of security-related information generated by assessments and monitoring;

f. Response actions to address results of the analysis of security-related information; and

g. Reporting the security status of organization and the information system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].

The company has established a set of metrics to continuously monitor the security of the system with the following sample frequencies:

- Ongoing: Information system monitoring; monitoring of auditable events; incident reporting when they occur, inventory, vulnerability scanning.

- Weekly: Audit review, analysis, and reporting.

- Monthly: Operating system/Infrastructure, database, and web application vulnerability scanning (authenticated with administrator credentials); Internal report of security state; Flaw remediation; Automatic termination of temporary and emergency accounts after no more than thirty (30) days; and Verification of correct operation of security functions.

- Quarterly: Disable inactive user accounts (other quarterly monitoring is not applicable).

- Annually: Review and update, as necessary, system policies and procedures; security awareness and training refresher; review and update list of auditable events are necessary; penetration testing; review / update system baseline configuration; review and update, as necessary, the Configuration Management Plan and IT Contingency Plan; perform Contingency Plan training, test, and exercises; test backups; perform incident response training, testing, and exercises; review and update, as necessary, the Incident Response Plan; review and Update, as necessary, the SSP / Security Controls Framework; review and update of access agreements/rules of behavior; and re-sign access agreements/rules of behavior.

Annual assessments and in-depth monitoring are completed by an independent assessor according to the metrics and frequencies to ensure compliance with all vulnerability mitigation procedures.

The implementation of a continuous monitoring program must result in ongoing updates to the SSP / Security Controls Framework. System changes and improvements to the system environment are documented in updated inventories, diagrams, procedures, and recorded in the change management ticketing system ServiceNow system as the system of record (CMDB) for correlation and analysis of information across the enterprise. The implementation of this continuous monitoring program responds to security alerts, bulletins, and output from scanning activities by categorizing the item per the severity that has been assigned; the severity determines the timeframe for remediation according to scoring, such as CVSS, and as outlined in the Vulnerability and Security Risk Management Technical Requirements. The company uses information obtained from continuous monitoring and ongoing assessments of the system to report the security status of the system. This is done via vulnerability scan results for example. As an example, regular operating system scans are performed using Qualys. The results of these scans are included in reports for action. In addition, web application scans are performed using Qualys and Twistlock for container-based scanning. Scan results are included in vulnerability reports for automated action in ServiceNow. Has the institution or department implemented a continuous monitoring program that includes configuration management, ongoing security control assessments, and reporting on the information system and its constituent components? Obtain certification and accreditation policy; procedures addressing continuous monitoring of information system security controls; NIST Special Publications 800-37 and 800-53A; security plan; security assessment report; plan of action and milestones; information system monitoring records; security impact analyses; status reports; security plan; other relevant documents or records and ascertain if:

(I)the organization monitors the security controls in the information system on an ongoing basis.

(ii)the organization employs a security control monitoring process consistent with NIST Special Publications 800-37 and 800-53A.

(iii)the organization conducts security impact analyses on changes to the information system.

(iv)the organization documents and reports changes to or deficiencies in the security controls employed in the information system.

Identify -> Critical Information Asset Inventory The organization:

a. Establishes and documents configuration settings for information technology products employed within the information system using [State of Arizona Configuration Baseline (SACB)] that reflect the most restrictive mode consistent with operational requirements;

b. Implements the configuration settings;

c. Identifies, documents, and approves any deviations from established configuration settings for [Assignment: organization-defined information system components] based on [Assignment: organization-defined operational requirements]; and

d. Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.

The Security Team has established and documented configuration settings and secure hardening standards for all components that are deployed within the environment using Center for Internet Security (CIS) Guidelines (Level 1) Benchmarks, and vendor hardening best practices. The configuration settings are part of Security Controls Framework configuration baselines, and it reflects the most restrictive mode consistent with operational requirements. The company uses automated mechanisms to centrally manage, apply, and verify baseline configuration settings for systems under configuration management, where feasible.

The companys has an Infrastructure-as-a-Service (IaaS) Team that has implemented approved configuration settings across all system components. They have established the Golden Image repository that centrally manages both server and container images within a security-approved project. Qualys (server) and Twistlock (container) are used to scan for vulnerabilities prior to the Golden Image release from IaaS, during the CI/CD process managed by Application Teams and prior to entering User Acceptance Testing and Production.

Company Application Teams, the Security Team and the Change Management Team identifies, documents, and approves any deviations from established configuration settings for all Equifax components based on system need and business justifications. Security scans for deviations to baseline configurations and reports issues through the vulnerability management process.

Equifax Application Teams and Security Teams monitors and controls changes to the configuration settings in accordance with policies and procedures. The company uses automated tools (Chef for initial compute image hardening and Jenkins to deploy all configurations in production) to centrally manage, apply, and verify baseline configuration settings for systems under configuration management where feasible, and access to the configuration management tools and software packages are restricted to those required and approved to operate the tools. The company also has several monitoring and security management software/agents installed in the system environment, and the Security Team scans for deviations to baseline configurations and reports issues through the vulnerability management process. Equifax also operates and maintains compliance scanning tools to alert on the following:

Out of compliance services or hosts that are found Scan systems for compliance with approved configuration baseline Perform both agent based and agentless compliance scanning Scan network devices for compliance with approved baseline standards Scan cloud management platforms for configuration compliance violations Scan cloud tools and infrastructure components for compliance violations Does the institution or department have processes in place to monitor and control changes to the baseline configuration settings of information systems in accordance with organizational policies and procedures? Obtain configuration management policy; procedures addressing configuration settings for the information system; information system configuration settings and associated documentation; NIST Special Publication 800-70; other relevant documents or records and ascertain if:

(I)the organization establishes mandatory configuration settings for information technology products employed within the information system.

(ii)the organization configures the security settings of information technology products to the most restrictive mode consistent with operational requirements.

(iii)the organization documents the configuration settings.

(iv)the organization enforces the configuration settings in all components of the information system.

Protect -> Network Access and Perimeter Controls The organization:

a. Configures the information system to provide only essential capabilities; and

b. Prohibits or restricts the use of the following functions, ports, protocols, and/or services: [Assignment: organization-defined prohibited or restricted functions, ports, protocols, and/or services].

The system is configured to only provide capabilities necessary for proper operation of the system, including the necessary functions, ports, protocols, and services as outlined in their documentation. All non-secure and unnecessary functions, ports, protocols, and services are disabled. The Infrastructure-as-a-Service (IaaS) Team maintains a configuration baseline for the environment. Each component is hardened in accordance with the applicable CIS Benchmarks Level 1 to ensure the most secure and restrictive settings are configured.

The Security Team ensures that CIS Benchmarks Level 1 are applied to each component before Application Teams deploy those components into Production. Vulnerability scanning is implemented throughout the SDLC to check for unnecessary ports, protocols and/or services are running in each environment. Equifax uses tools like Wiz or Qualys to conduct scans and these scans are run against known restricted ports, protocols and/or services. This is validated by the Security Team. Only functions, ports, protocols, and services necessary for proper operation of the environment are enabled.

he EFX Security Team conducts regular compliance scans and reviews scan reports to identify unnecessary and/or unsecure functions, ports, protocols, and services. Any unnecessary functions, ports, protocols, and services identified are disabled. For any unnecessary functions, ports, protocols, and services identified that must be disabled, a change ticket will be submitted for the appropriate actions to be taken. New golden images are built monthly to support hardening and removing of vulnerabilities in base images. We builds environments using preconfigured images that are deployed from Jenkins.