Especially in environments of the highest classification levels, it is often justified to physically disable unnecessary components by removing them from the device (for example, wireless network cards, cameras, microphones). In cases where the component cannot be physically removed, alternative protections may include taping over cameras and disabling the component at user setting, operating system, and firmware levels. In some operating systems, protection can also be enhanced by removing the software components (kernel modules) associated with the device.

In processing environments of classification levels III-II, the requirement must take into account the possible levels included in hardening guidelines, as well as the use of multiple different hardening guidelines—such as vendor-specific instructions, CIS Benchmarks, and DISA STIG to ensure comprehensive coverage of hardening measures.

Kovennusten voimassaolosta ja vaikuttavuudesta huolehditaan koko tietojärjestelmän elinkaaren ajan.

Only those components, services, and user and process privileges that are necessary to meet operational requirements and ensure security are enabled in the systems.