CIS HashiCorp Vault Benchmark

This recommendation verifies that Vault Is Installed from Official Sources on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Vault Is Installed from Official Sources. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Vault Is Installed from Official Sources. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Vault Runs Under a Dedicated User on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Vault Runs Under a Dedicated User. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Vault Runs Under a Dedicated User. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Latest Stable Version Is Installed on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Latest Stable Version Is Installed. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Latest Stable Version Is Installed. Apply changes via configuration files or the management CLI/API and restart the service if required.

This setting ensures that Vault Configuration File Permissions Are Restricted on the HashiCorp Vault secrets management platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the HashiCorp Vault secrets management platform is essential for defense in depth.

Review the HashiCorp Vault Vault configuration and verify that Vault Configuration File Permissions Are Restricted. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Vault Configuration File Permissions Are Restricted. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Integrated Storage (Raft) Uses Encrypted Paths on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Integrated Storage (Raft) Uses Encrypted Paths. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Integrated Storage (Raft) Uses Encrypted Paths. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Storage Backend TLS Is Enabled on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Storage Backend TLS Is Enabled. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Storage Backend TLS Is Enabled. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Consul Storage Uses ACL Tokens on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Consul Storage Uses ACL Tokens. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Consul Storage Uses ACL Tokens. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Root Token Is Revoked After Initial Setup on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Root Token Is Revoked After Initial Setup. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Root Token Is Revoked After Initial Setup. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Token TTLs Are Configured on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Token TTLs Are Configured. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Token TTLs Are Configured. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Periodic Tokens Are Used Where Appropriate on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Periodic Tokens Are Used Where Appropriate. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Periodic Tokens Are Used Where Appropriate. Apply changes via configuration files or the management CLI/API and restart the service if required.

This setting ensures that Orphan Token Creation Is Restricted on the HashiCorp Vault secrets management platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the HashiCorp Vault secrets management platform is essential for defense in depth.

Review the HashiCorp Vault Vault configuration and verify that Orphan Token Creation Is Restricted. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Orphan Token Creation Is Restricted. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that LDAP or OIDC Auth Is Configured for Users on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that LDAP or OIDC Auth Is Configured for Users. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure LDAP or OIDC Auth Is Configured for Users. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that AppRole Auth Is Configured for Applications on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that AppRole Auth Is Configured for Applications. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure AppRole Auth Is Configured for Applications. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Kubernetes Auth Is Configured for K8s Workloads on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Kubernetes Auth Is Configured for K8s Workloads. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Kubernetes Auth Is Configured for K8s Workloads. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Unused Auth Methods Are Disabled on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Unused Auth Methods Are Disabled. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Unused Auth Methods Are Disabled. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that KV Secrets Engine Uses Version 2 on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that KV Secrets Engine Uses Version 2. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure KV Secrets Engine Uses Version 2. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Dynamic Secrets Are Used Over Static Credentials on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Dynamic Secrets Are Used Over Static Credentials. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Dynamic Secrets Are Used Over Static Credentials. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that PKI Engine Certificate TTLs Are Reasonable on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that PKI Engine Certificate TTLs Are Reasonable. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure PKI Engine Certificate TTLs Are Reasonable. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Policies Follow Least Privilege on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Policies Follow Least Privilege. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Policies Follow Least Privilege. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Default Policy Is Reviewed and Restrictive on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Default Policy Is Reviewed and Restrictive. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Default Policy Is Reviewed and Restrictive. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Sentinel Policies Are Used for Enforcement on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Sentinel Policies Are Used for Enforcement. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Sentinel Policies Are Used for Enforcement. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Root or Sudo Capabilities Are Minimized on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Root or Sudo Capabilities Are Minimized. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Root or Sudo Capabilities Are Minimized. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that at Least One Audit Device Is Enabled on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that at Least One Audit Device Is Enabled. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure at Least One Audit Device Is Enabled. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Audit Logs Are Sent to Remote SIEM on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Audit Logs Are Sent to Remote SIEM. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Audit Logs Are Sent to Remote SIEM. Apply changes via configuration files or the management CLI/API and restart the service if required.

This setting ensures that Audit Log File Permissions Are Restricted on the HashiCorp Vault secrets management platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the HashiCorp Vault secrets management platform is essential for defense in depth.

Review the HashiCorp Vault Vault configuration and verify that Audit Log File Permissions Are Restricted. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Audit Log File Permissions Are Restricted. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that HMAC Accessor Is Enabled in Audit Logs on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that HMAC Accessor Is Enabled in Audit Logs. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure HMAC Accessor Is Enabled in Audit Logs. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Raw Audit Logging Is Disabled on the HashiCorp Vault secrets management platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the HashiCorp Vault secrets management platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Review the HashiCorp Vault Vault configuration and verify that Raw Audit Logging Is Disabled. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Raw Audit Logging Is Disabled. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Audit Log Rotation Is Configured on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Audit Log Rotation Is Configured. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Audit Log Rotation Is Configured. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that TLS Is Enabled for API Listener on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that TLS Is Enabled for API Listener. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure TLS Is Enabled for API Listener. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that TLS 1.2 Is the Minimum Version on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that TLS 1.2 Is the Minimum Version. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure TLS 1.2 Is the Minimum Version. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Client Certificate Authentication Is Configured on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Client Certificate Authentication Is Configured. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Client Certificate Authentication Is Configured. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Vault Listener Is Bound to Specific Interfaces on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Vault Listener Is Bound to Specific Interfaces. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Vault Listener Is Bound to Specific Interfaces. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Cluster Communication Uses TLS on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Cluster Communication Uses TLS. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Cluster Communication Uses TLS. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that UI Is Disabled in Production If Not Needed on the HashiCorp Vault secrets management platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the HashiCorp Vault secrets management platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Review the HashiCorp Vault Vault configuration and verify that UI Is Disabled in Production If Not Needed. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure UI Is Disabled in Production If Not Needed. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Rate Limiting Is Configured on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Rate Limiting Is Configured. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Rate Limiting Is Configured. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Auto-Unseal Is Configured with Cloud KMS on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Auto-Unseal Is Configured with Cloud KMS. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Auto-Unseal Is Configured with Cloud KMS. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Shamir Seal Key Shares Are Distributed Securely on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Shamir Seal Key Shares Are Distributed Securely. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Shamir Seal Key Shares Are Distributed Securely. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Recovery Keys Are Stored Securely on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Recovery Keys Are Stored Securely. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Recovery Keys Are Stored Securely. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Lease TTLs Are Reviewed and Reasonable on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Lease TTLs Are Reviewed and Reasonable. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Lease TTLs Are Reviewed and Reasonable. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Vault Health Endpoint Is Monitored on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Vault Health Endpoint Is Monitored. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Vault Health Endpoint Is Monitored. Apply changes via configuration files or the management CLI/API and restart the service if required.

This recommendation verifies that Replication Uses Encrypted Transport on the HashiCorp Vault secrets management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the HashiCorp Vault secrets management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Review the HashiCorp Vault Vault configuration and verify that Replication Uses Encrypted Transport. Check the configuration files or use the CLI/API to confirm.

Update the HashiCorp Vault Vault configuration to ensure Replication Uses Encrypted Transport. Apply changes via configuration files or the management CLI/API and restart the service if required.