Skip to main content
govconCyber — Federal Cybersecurity Law Reference
Back to results
NIST 800-171 R-3.4.2

Enforce Security Configuration Settings

Official citation: 3.4.2

Class: core · Severity: high

Statement of the obligation — verify against source

3.4.2

What it means

Define and enforce secure configuration settings for the IT products in your systems — servers, workstations, network gear, operating systems, and applications. Set security-relevant parameters (registry settings, permissions, ports, protocols, remote connections) at the organization level and apply them as part of each system's baseline. Recognized hardening guides and benchmarks (such as STIGs and security checklists) provide established secure-configuration starting points.

Educational reference only — not legal advice. Consult a qualified assessor or attorney for binding compliance determinations.