Skip to content

DigitalOcean configuration hardening security checks

Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.

On DigitalOcean, Black Cat runs 16 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the DigitalOcean connector needs.

Checks (16)

severity: medium Email Not Verified fix difficulty: easy #

Verify the DigitalOcean account email address

  1. Log in to the DigitalOcean Cloud Control Panel at cloud.digitalocean.com
  2. Click your avatar in the top-right corner and select "My Account"
  3. Navigate to the "General" tab under Account Settings
  4. Locate the Email section and click "Resend verification email"
  5. Open the verification email and click the confirmation link
  6. Refresh the account settings page to confirm the email is now verified

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Backups Disabled fix difficulty: easy #

Enable automated weekly backups for the Droplet

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Droplets and click the affected Droplet name
  3. Select the "Backups" tab in the Droplet detail view
  4. Click "Enable Backups" and confirm the action
  5. Verify the next scheduled backup time is shown in the Backups section

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1c HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low IPv6 Disabled fix difficulty: easy #

Enable IPv6 networking on the Droplet

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Droplets and click the affected Droplet name
  3. Select the "Networking" tab
  4. Under "IPv6", click "Enable IPv6" and confirm
  5. Update the Droplet's network configuration file (if required) to bring up the IPv6 interface
  6. Verify the assigned IPv6 address appears in the Networking tab

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low No Droplets Attached fix difficulty: easy #

Attach Droplets or tags to the firewall or delete unused firewall rules

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Networking > Firewalls and click the affected firewall name
  3. Select the "Droplets" tab
  4. Click "Add Droplets" and select the Droplets or tag that this firewall should protect
  5. If the firewall is no longer needed, click "Delete" from the firewall settings to remove it
  6. Verify the protected Droplets are listed in the Droplets tab

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Outdated Version fix difficulty: hard #

Upgrade the managed database cluster to a supported major version

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Databases and click the affected database cluster name
  3. Select the "Settings" tab and check for an available "Upgrade" option
  4. Review the DigitalOcean documentation for the supported version matrix and migration steps
  5. Schedule a maintenance window and initiate the version upgrade
  6. Monitor the upgrade progress and test application connectivity after completion

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium No Backups fix difficulty: easy #

Enable automated daily backups for the managed database cluster

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Databases and click the affected database cluster name
  3. Select the "Backups" tab
  4. Confirm that automatic backups are enabled (they are on by default for managed databases)
  5. If backups are disabled, contact DigitalOcean support or recreate the cluster with backups enabled
  6. Set a preferred backup window to minimise I/O impact during peak hours

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1c HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Outdated Kubernetes Version fix difficulty: medium #

Upgrade the DOKS cluster to a current supported Kubernetes version

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Kubernetes and click the affected cluster name
  3. Select the "Overview" tab and look for the "Upgrade" banner or button
  4. Review the release notes for the target version and ensure workloads are compatible
  5. Click "Upgrade" and select the desired Kubernetes version
  6. Monitor the rolling upgrade of nodes and verify workloads are healthy after completion

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Auto Upgrade Disabled fix difficulty: easy #

Enable automatic upgrades for the DOKS cluster to receive patch releases automatically

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Kubernetes and click the affected cluster name
  3. Select the "Settings" tab
  4. Find the "Auto Upgrade" toggle and enable it
  5. Optionally configure a preferred maintenance window for upgrade execution
  6. Save the settings and confirm that auto-upgrade is shown as enabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Surge Upgrade Disabled fix difficulty: easy #

Enable surge upgrades on the DOKS cluster to allow zero-downtime node pool upgrades

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Kubernetes and click the affected cluster name
  3. Select the "Settings" tab
  4. Locate the "Surge Upgrade" option and enable it
  5. Save the settings and verify the surge upgrade option is active

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low No Garbage Collection fix difficulty: easy #

Enable automatic garbage collection for the container registry to reclaim storage

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Container Registry and click the registry name
  3. Select the "Settings" tab
  4. Enable the "Garbage Collection" option to automatically remove unreferenced image layers
  5. Optionally schedule garbage collection during off-peak hours
  6. Save the settings and confirm the garbage collection status is active

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: info Basic Tier fix difficulty: easy #

Upgrade the container registry to a higher subscription tier for additional features

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Container Registry and click the registry name
  3. Select the "Settings" tab and locate the "Subscription Plan" section
  4. Click "Upgrade Plan" and choose a suitable tier (Basic, Starter, or Professional)
  5. Review the storage and repository limits for the selected tier
  6. Confirm the upgrade; billing will be prorated for the current month

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Kubernetes HA Disabled fix difficulty: easy #

Enable high availability for the Kubernetes control plane to prevent single-point-of-failure outages

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Kubernetes and click the affected cluster name
  3. Select the "Settings" tab
  4. Enable the "High Availability Control Plane" option
  5. Save the change and wait for the control plane upgrade to complete
  6. Verify the cluster shows HA status as active

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1c HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Kubernetes No Registry Integration fix difficulty: easy #

Integrate the Kubernetes cluster with the DigitalOcean container registry for secure image pulls

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Container Registry and click the registry name
  3. Select the "Settings" tab and locate "DigitalOcean Kubernetes integration"
  4. Click "Edit" and select the Kubernetes cluster to integrate
  5. Save the integration; the cluster will receive credentials to pull images from the private registry
  6. Verify pods can pull images from the registry without imagePullSecrets

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Database No Maintenance Window fix difficulty: easy #

Configure a maintenance window so database patches are applied during a predictable low-traffic period

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Databases and click the affected database cluster name
  3. Select the "Settings" tab and locate "Maintenance Window"
  4. Click "Edit" and choose a day and time window during your lowest-traffic period
  5. Save the maintenance window configuration
  6. Verify the next scheduled maintenance is listed in the database overview

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Database Single Node fix difficulty: easy #

Add standby nodes to the database cluster for high availability and failover protection

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Databases and click the affected database cluster name
  3. Select the "Settings" tab and locate "Cluster Configuration"
  4. Click "Resize" and increase the number of nodes to at least 2 (primary + standby)
  5. Save and wait for the standby node to provision and synchronize
  6. Verify the cluster shows the new node count and replication status is healthy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1c HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Droplet Powered Off fix difficulty: easy #

Review powered-off Droplets and either restart or delete them to reduce stale resource risk

  1. Log in to the DigitalOcean Cloud Control Panel
  2. Navigate to Manage > Droplets and identify Droplets with "Off" status
  3. Determine whether each powered-off Droplet is still needed
  4. If the Droplet is needed, click "Power On" to restart it
  5. If the Droplet is no longer needed, click "Destroy" and confirm deletion
  6. Remove any associated resources (volumes, snapshots, floating IPs) if no longer required

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

More DigitalOcean checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial