Mechanisms exist to ensure vendors / manufacturers: ▪ Deliver the system, component, or service with a pre-established, secure configuration implemented; and ▪ Use the pre-established, secure configuration as the default for any subsequent system, component, or service reinstallation or upgrade.