Chapter 9: Compliance Frameworks

1. (1)
   Using the out-of-the-box settings for the firewall runs counter to requirement 2. To comply with the do not use vendor-supplied defaults for system passwords and other security parameters requirement, custom passwords and settings should be used. Installing a firewall is covered in requirement 1, while applying patches and updates is covered in requirement 6.
2. (2)
   The threat landscape is constantly changing, so it is important to maintain and evolve security awareness across the organization. Maintaining training programs is important, but these must also evolve to account for the changing threat landscape.
   Imposing strict access controls is not defined well enough to be applicable here. Access control should be appropriate; controls that are too strict might limit accountability and transparency that's required by SOX. Third-party software...