Question

A security architect adopts a vendor-published security baseline for the organization's Windows servers. During implementation, she discovers that 12 legacy application servers cannot support one of the baseline's mandatory controls (a modern TLS cipher configuration) because doing so would break a critical business application that the vendor no longer updates. Management insists the application must remain operational. What is the MOST appropriate action for the architect to take regarding the baseline?

Accepted Answer

Tailor the baseline for those systems by documenting the deviation and applying compensating controls

Answer

Scope out the 12 legacy servers entirely so no baseline controls apply to them

Answer

Abandon the baseline and allow each server owner to define their own controls

Answer

Force the mandatory control on all servers to maintain a uniform baseline regardless of business impact