Question

An information security manager has established a hardened configuration baseline for all servers. During a review, a critical legacy application server is found to deviate from the baseline because a required patch would break the vendor-supplied application, which cannot be upgraded. What is the BEST course of action?

Accepted Answer

Document a formal, risk-based exception with compensating controls and a defined review date

Answer

Force the server into full baseline compliance immediately, accepting the resulting application outage

Answer

Remove the legacy server from the scope of the baseline standard permanently

Answer

Lower the organization-wide baseline so that all servers can meet it consistently