A financial services firm has standardised a hardened build for its Windows 10 workstations using a CIS benchmark. Over six months, audit sampling shows that 18% of deployed workstations now drift from the baseline because field engineers install ad-hoc utilities. The CISO asks the security operations manager to address the drift. Which action should the manager take FIRST?
- ARe-image every drifted workstation overnight to force a clean return to the approved baseline build.
- BTighten the local administrator policy so that only the helpdesk can install software on each workstation in the estate.
- CDeploy a configuration management tool that continuously reports deviations against the documented baseline and feeds findings to operations. Correct
- DUpdate the workstation baseline document to reflect the engineering utilities that are commonly being installed in the field.
Why A is wrong: Mass re-imaging treats the symptom, not the cause. Without a sustained detection and prevention process the drift will simply reappear once engineers reinstall their tools, and the disruption is hard to justify to the business.
Why B is wrong: Removing local admin is a sensible hardening control but it is a preventive change made without first measuring the drift problem. CM doctrine is to baseline and monitor before tightening, otherwise the manager cannot show the change actually worked.
Why C is correct: Visibility precedes correction. Continuous monitoring against an authoritative baseline lets the manager quantify drift, target enforcement, and prove control effectiveness to auditors, which is the risk-led first step in CM.
Why D is wrong: Quietly widening the baseline to match observed behaviour normalises uncontrolled change and undermines the benchmark. Baselines change through a change control board, not by absorbing unmanaged drift.