Golden configuration

A golden configuration is the approved state of a device or service — the firewall policy as it should read, the TLS policy a load balancer should enforce, the logging, time-sync and authentication settings every switch should carry. It is a baseline the organization owns and reviews, as distinct from a vendor default or whatever happens to be running today.

Golden configurations make compliance mechanical. Once one exists, the question “is this device compliant?” is a diff, and the question “what changed?” has an answer with a line number. Published benchmarks such as CIS are golden configurations somebody else wrote; most organizations use them as a starting point and then tighten or relax specific rules to match their own risk appetite.