Baseline · Exposure & network
A-02 No public ports open by default
criticalnetwork · auto
Why it matters
Exposing to the internet requires an explicit action with a warning; no default port-forwarding.
How to test
Port-scan the public interface (e.g. nmap) to see what is open.
How to fix
Close unnecessary ports; expose only when needed and always behind auth.