BAC 2.x Operational Best Practices and Governance

Always validate in Audit Mode before promoting to Enforcement Mode

Always deploy new policies or policy changes in Audit Mode within a UAT ring before promoting to Enforcement Mode in production.

In Audit Mode, Windows Code Integrity logs blocked execution events without actually blocking them. This lets you identify legitimate applications that would be denied under the new policy — and add the appropriate rules — before enforcement affects production workloads.

Site prefix lifecycle governance: Review, Deployed, and Archive

The BAC 2.x site engine uses a configurable Site Prefix to organize policy assets across three custom BigFix sites. Treat each site as a distinct stage in the policy promotion pipeline:

<Prefix>_Review

Holds draft XML policy files for administrative inspection and rule verification before publication. No policy in this site has been compiled or signed. This is the only stage where policy XML is safe to edit directly.

<Prefix>_Deployed

Houses compiled, TPM-signed .cip binaries approved for active production enforcement. Task 357 distributes content from this site to subscribed endpoints.

<Prefix>_Archive

Preserves historical XML source and compiled .cip binaries whenever policies are updated. This site provides the full audit trail of every policy version ever deployed.

Do not manually modify or delete content in the Archive site. The BAC automation manages this site as an immutable history record. Manual edits will corrupt the audit trail.

Preserve Web Reports audit history when removing rules

Assign unique names to each new policy iteration. When you need to disable an existing rule while retaining its history in BigFix Web Reports, use the Purge Supplemental Policy Rule Fixlet rather than overwriting the existing policy file.

Overwriting a policy file replaces the record in Web Reports and destroys the audit trail for that rule. The Purge Supplemental Policy Rule Fixlet disables the rule in a way that Analysis 306 tracks as a state change, preserving the full record of when the rule was active and when it was removed — which is essential for compliance audits and incident investigations.

Manage signing certificate expiration proactively

Use Analysis 305 – Certificate Monitor v2.x to track certificate expiration dates and thumbprint associations across your managed environment. A signing certificate that expires while policies are in active use will prevent Task 355 from compiling new .cip binaries until the certificate is renewed and re-provisioned via Task 353.

Plan certificate renewals well in advance of the expiration date. A signing outage during a critical policy update window — for example, during an incident response — has no short-term workaround other than an emergency renewal.