Entry points that answer without a signed-in user must be inventoried and justified

Control Statement: The organisation must maintain an inventory of every endpoint the instance answers without an authenticated user, recording for each what it exposes and the justification for it being open.

Description: Parts of a Creatio instance necessarily answer before anyone signs in: the sign-in page itself, password recovery, self-registration where enabled. Implementations add to this surface — landing pages, web forms, anonymous web services built for integrations that could not hold a credential. This control requires an inventory of that surface: each unauthenticated endpoint, what it reveals or accepts, and why it is open. Endpoints without a justification must be closed.

Rationale: The unauthenticated surface is the portion of the instance already conceded to any attacker, before credentials, lockout or session policy get a say — every other control in this benchmark starts one step later. Its danger is that it only grows, and grows silently: an anonymous service added for one integration in one release remains open across every release after, with nothing inside the product listing what has accumulated. An inventory is the only way the organisation can even state what it has conceded — and the endpoint nobody wrote down is reliably the one built quickly, for a system that no longer exists, by somebody who has left.

Audit Procedure:

1. Obtain the inventory of unauthenticated entry points.
2. Enumerate the actual surface with the implementation team: the stock pages (sign-in, recovery, self-registration where enabled) and every anonymous service or form added during implementation, including in configuration files where the deployment is on-site.
3. Confirm each discovered endpoint appears in the inventory with what it exposes and its justification.
4. Confirm each inventoried endpoint still answers as described — an entry that no longer matches the instance means the inventory is not being maintained.
5. Record as non-compliant any endpoint absent from the inventory or lacking a justification.

Remediation:

1. Enumerate the unauthenticated surface with whoever maintains the implementation and its hosting.
2. Close endpoints without a current justification, and observe what stops.
3. Record the remainder: endpoint, what it exposes or accepts, and the justification.
4. Add the inventory to the periodic security review, and to the definition of done for any change that opens a new unauthenticated endpoint.

Default Value: Out of the box the unauthenticated surface is limited to sign-in and account recovery. Creatio maintains no list of endpoints added to that surface by an implementation; anonymous services accumulate without appearing in any administration screen.